CVE-2026-97481

What the bug is

There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase. The reason for the soft lockup in the ISR is the missing FIFO error IRQ (FIFOE) handling. Not handling it and reporting IRQ_HANDLED triggers the IRQ immediately again. Fix this by adding a check for the FIFOE status and clearing the FIFO if no data is ready (DR). This behavior was observed on an AM62L device which uses the OMAP 8250 driver. Fix it for all 8250 drivers, since the OMAP driver's special IRQ setup handling may trigger this behavior more frequently, but it is not ensured that other 8250 drivers aren't affected.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/tty/serial/8250/8250_port.c

What this is

8250/16?50 (AND CLONE UARTS) SERIAL DRIVERMAINTAINERS section matched on drivers/tty/serial/8250* · linux-serial@vger.kernel.org · Maintained

Check it on the machine

grep -w CONFIG_SERIAL_8250 /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormy
• trixie, forky, sidYnot built on s390x/s390x
• bookworm · linux-6.12y

y

built into the kernel image on every flavour - only a patch removes it

Y

built in where it is built at all; some flavours do not build it

Build switch

CONFIG_SERIAL_8250

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-24 (24 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.17%, higher than 6.2% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/tty

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.12	5.10.271	4bce4a6f6318
2.6.12	5.15.222	8b67af8cd905
2.6.12	6.1.189	95d0b40c0623
2.6.12	6.6.158	03ed804a0ddc
2.6.12	6.12.111	2881b2e6da02
2.6.12	6.18.53	4295c58990b7
2.6.12	7.2	0c6bf45e5a34

Debian advisories