CVE-2023-53094 tty: serial: fsl_lpuart: fix race on RX DMA shutdown
A race condition in the Linux kernel's fsl_lpuart serial driver can cause a null pointer dereference and system crash during DMA shutdown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53094?
CVE-2023-53094 is a high-severity vulnerability in Linux kernel, published on 2 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tty: serial: fsl_lpuart: fix race on RX DMA shutdown
From time to time DMA completion can come in the middle of DMA shutdown:
<process ctx>: <IRQ>: lpuart32_shutdown() lpuart_dma_shutdown() del_timer_sync() lpuart_dma_rx_complete() lpuart_copy_rx_to_tty() mod_timer() lpuart_dma_rx_free()
When the timer fires a bit later, sport->dma_rx_desc is NULL:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 pc : lpuart_copy_rx_to_tty+0xcc/0x5bc lr : lpuart_timer_func+0x1c/0x2c Call trace: lpuart_copy_rx_to_tty lpuart_timer_func call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq __irq_exit_rcu irq_exit handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler ...
To fix this fold del_timer_sync() into lpuart_dma_rx_free() after dmaengine_terminate_sync() to make sure timer will not be re-started in lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete().
Weakness: CWE-362
Which versions are affected by CVE-2023-53094?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53094?
Apply the vendor's patch.
Is CVE-2023-53094 being exploited?
There is no known exploitation of CVE-2023-53094 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53094, DEBIAN-CVE-2023-53094, GHSA-25vh-j698-43q9, UBUNTU-CVE-2023-53094.