CVE-2026-80737

CVE-2026-80737 is a race condition in the Linux kernel's AMBA PL011 serial driver (amba-pl011): during DMA teardown the driver used dmaengine_terminate_all(), which does not wait for a running callback, so the TX DMA callback could still access the TX buffer after it had been freed. A second unsynchronized access existed in the RX poll timer, which read RX buffers without holding the port lock. Triggering requires local, low-privilege access to a PL011 serial port operating with DMA during teardown, and the resulting use-after-free can corrupt kernel memory, potentially allowing disclosure, tampering, or denial of service (CVSS 3.1: 7.8 High). Only Linux systems that actually use the PL011 UART with DMA — predominantly ARM-based boards, embedded devices and ARM servers — are meaningfully affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Apply your distribution or vendor's kernel update containing the amba-pl011 fix that switches DMA teardown to dmaengine_terminate_sync() and removes the RX poll timer before freeing buffers (no fixed version number is given in this record, so track your vendor's stable update). Check whether your ARM systems actually enable DMA on the PL011 UART; if the driver is unused or the serial port is not accessible to local users, exposure is minimal. Given the local attack vector and no known exploitation or PoC, routine patching cycles are adequate unless serial devices are exposed to untrusted local users.