CVE-2026-74653 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using LPC32xx devices, should assess exposure and prioritize patching. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while

Why it matters

Defenders should prioritize verifying and applying patches to affected Linux kernel versions, particularly those using LPC32xx devices, to prevent potential CPU livelock and system instability.

• Potential CPU livelock due to interrupt storm
• Increased system resource utilization
• Possible system instability or crashes

Technical summary

The Linux kernel's serial: 8250_of driver has a vulnerability that can cause a stuck empty-FIFO RX-timeout on LPC32xx devices. This issue is triggered when the RX FIFO is empty and the UART latches an RX character-timeout interrupt, leading to an interrupt storm that livelocks the CPU. The problem arises because the serial8250_rx_chars() function only reads the Receive Holding Register (RHR) when the Data Ready (DR) bit is set in the Line Status Register (LSR), but it does not handle the case where the RX timeout interrupt is triggered without a character being received.

Defensive priority

Defenders should prioritize verifying and applying patches to affected Linux kernel versions, particularly those using LPC32xx devices.

Recommended defensive actions

• Verify and apply patches to affected Linux kernel versions
• Review and update Linux kernel configurations to prevent similar issues
• Monitor system logs for signs of interrupt storms
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is caused by the Linux kernel's failure to clear the RX character-timeout interrupt when the RX FIFO is empty on LPC32xx devices. This results in an interrupt storm that livelocks the CPU. The issue is reproducible when userspace repeatedly opens the front-panel port (ttyS1). The vulnerability was resolved by adding a hardware-specific handle_irq for PORT_LPC3220, which clears the RX timeout interrupt when the FIFO is empty.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.