# CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

> A local attacker can cause a CPU livelock and system hang by repeatedly opening the LPC32xx UART port, triggering an infinite interrupt storm in the Linux kernel.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 22 Aug 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-97184, BELL-CVE-2026-74653, DEBIAN-CVE-2026-74653, GHSA-hpjx-f9r3-xj76, UBUNTU-CVE-2026-74653

## What is CVE-2026-74653?

CVE-2026-74653 is a denial of service vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

The NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout
interrupt while the RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT
(0x0c) but LSR.DR is clear. A character timeout is only cleared by
reading RHR, but serial8250_rx_chars() reads RHR only when LSR.DR is
set, so nothing ever clears the condition. The interrupt is
level-triggered and re-fires immediately, so on a single-core ARM926
the resulting interrupt storm livelocks the CPU.

It is reproducible when userspace repeatedly opens the front-panel port
(ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and
the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping
the soft-lockup detector in serial8250_handle_irq_locked().

LPC32xx has no dedicated 8250 glue driver, it's driven by the generic
8250_of. Add a hardware specific handle_irq for PORT_LPC3220, wired up
in of_platform_serial_setup() the same way fsl8250_handle_irq is
installed. The handler follows dw8250_handle_irq(): on an RX timeout
with an empty FIFO (LSR.DR and LSR.BI clear) it does one throwaway RHR
read to clear the condition, then calls serial8250_handle_irq_locked().
No real received data is ever discarded, and it is a no-op on healthy
UARTs which never report a timeout with DR clear.

This is the same class of bug already worked around in other 8250 drivers;
see commit 424d79183af0 ("serial: 8250_dw: Avoid "too much work" from bogus rx timeout interrupt")
which reports the identical iir=0xcc/lsr=0x60. See also
UART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271.

## Which versions are affected by CVE-2026-74653?


## How do I fix CVE-2026-74653?

Apply the vendor's patch.

## Is CVE-2026-74653 being exploited?

There is no known exploitation of CVE-2026-74653 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74653 and fix it if it is affected.

What it is: CVE-2026-74653 is a denial of service vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74653 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74653/ (Markdown: https://insights.sbomify.com/CVE-2026-74653/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74653
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74653
- OSV: https://osv.dev/vulnerability/CVE-2026-74653

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74653/
Summaries are generated and may contain mistakes; the official description above is the record.