CVE-2026-63883

In the Linux kernel, the following vulnerability has been resolved:

serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

When uartflushbuffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uartportlock):

1. DMA starts: tx_remaining = N, kfifo contains N bytes
2. DMA completes in hardware; IRQ is pending but not yet delivered
3. uartflushbuffer() acquires the port lock and calls kfiforeset(), making kfifolen() = 0 while tx_remaining remains N
4. uartflushbuffer() releases the port lock
5. DMA IRQ fires; handletxdma() acquires the port lock and calls uartxmitadvance(uport, tx_remaining) on an empty kfifo

uartxmitadvance() increments kfifo->out by txremaining. Since kfiforeset() already set both in and out to 0, out wraps past in, causing kfifolen() to return UARTXMITSIZE - txremaining. The next starttxdma() call then submits a DMA transfer of stale buffer data.

Fix this by snapshotting kfifolen() at the start of handletxdma() and skipping uartxmitadvance() when fifolen < tx_remaining, which indicates the kfifo was reset by a preceding flush.