CVE-2026-74653

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NXP LPC32xx UART (PORT LPC3220) where an RX character-timeout interrupt can be latched while the RX FIFO is empty. In this state, the Interrupt Identification Register (IIR) reports UART IIR RX TIMEOUT (0x0c) but the Line Status Register Data (LSR.DR) is clear. Because the serial8250 rx chars() function only reads the Receiver Holding Register (RHR) when LSR.DR is set, the timeout condition is never cleared. Since the interrupt is level-triggered, it re-fires immediately, potentially causing an interrupt storm that livelocks the CPU on single-core ARM926 systems. This can be triggered when userspace repeatedly opens the front-panel port (ttyS1), causing serial8250 do set termios() to re-enable interrupts and trip the soft-lockup detector in serial8250 handle irq locked().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.