{"id":"CVE-2025-39724","title":"serial: 8250: fix panic due to PSLVERR","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix panic due to PSLVERR\n\nWhen the PSLVERR_RESP_EN parameter is set to 1, the device generates\nan error response if an attempt is made to read an empty RB…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 0b882f00655afefbc7729c6b5aec86f7a5473a3d","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < b8ca8e3f75ede308b4d49a6ca5081460be01bdb5","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 68c4613e89f000e8198f9ace643082c697921c9f","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < c826943abf473a3f7260fbadfad65e44db475460","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < cb7b3633ed749db8e56f475f43c960652cbd6882","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 8e2739478c164147d0774802008528d9e03fb802","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 38c0ea484dedb58cb3a4391229933e16be0d1031","Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 7f8fdd4dbffc05982b96caf586f77a014b2a9353","Linux 6d5e79331417886196cb3a733bdb6645ba85bc42","Linux 2401577586898b3590db80f8b97a26f81f0f6d4e","Linux >= 3.10.48 < 3.11","Linux >= 3.12.24 < 3.13","Linux 3.13"],"published":"2025-09-05","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:08:07.062Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39724","references":[{"url":"https://git.kernel.org/stable/c/0b882f00655afefbc7729c6b5aec86f7a5473a3d"},{"url":"https://git.kernel.org/stable/c/b8ca8e3f75ede308b4d49a6ca5081460be01bdb5"},{"url":"https://git.kernel.org/stable/c/68c4613e89f000e8198f9ace643082c697921c9f"},{"url":"https://git.kernel.org/stable/c/c826943abf473a3f7260fbadfad65e44db475460"},{"url":"https://git.kernel.org/stable/c/cb7b3633ed749db8e56f475f43c960652cbd6882"},{"url":"https://git.kernel.org/stable/c/8e2739478c164147d0774802008528d9e03fb802"},{"url":"https://git.kernel.org/stable/c/38c0ea484dedb58cb3a4391229933e16be0d1031"},{"url":"https://git.kernel.org/stable/c/7f8fdd4dbffc05982b96caf586f77a014b2a9353"}],"tags":["cve.org"],"epss":0.00174,"epssPercentile":0.06814,"ingestedAt":"2026-10-15T05:52:46.079Z","slug":"CVE-2025-39724","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix panic due to PSLVERR\n\nWhen the PSLVERR_RESP_EN parameter is set to 1, the device generates\nan error response if an attempt is made to read an empty RBR (Receive\nBuffer Register) while the FIFO is enabled.\n\nIn serial8250_do_startup(), calling serial_port_out(port, UART_LCR,\nUART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes\ndw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter\nfunction enables the FIFO via serial_out(p, UART_FCR, p->fcr).\nExecution proceeds to the serial_port_in(port, UART_RX).\nThis satisfies the PSLVERR trigger condition.\n\nWhen another CPU (e.g., using printk()) is accessing the UART (UART\nis busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==\n(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter\ndw8250_force_idle().\n\nPut serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock\nto fix this issue.\n\nPanic backtrace:\n[    0.442336] Oops - unknown exception [#1]\n[    0.442343] epc : dw8250_serial_in32+0x1e/0x4a\n[    0.442351]  ra : serial8250_do_startup+0x2c8/0x88e\n...\n[    0.442416] console_on_rootfs+0x26/0x70\n\n## Affected\n\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 0b882f00655afefbc7729c6b5aec86f7a5473a3d`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < b8ca8e3f75ede308b4d49a6ca5081460be01bdb5`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 68c4613e89f000e8198f9ace643082c697921c9f`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < c826943abf473a3f7260fbadfad65e44db475460`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < cb7b3633ed749db8e56f475f43c960652cbd6882`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 8e2739478c164147d0774802008528d9e03fb802`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 38c0ea484dedb58cb3a4391229933e16be0d1031`\n- `Linux >= c49436b657d0a56a6ad90d14a7c3041add7cf64d < 7f8fdd4dbffc05982b96caf586f77a014b2a9353`\n- `Linux 6d5e79331417886196cb3a733bdb6645ba85bc42`\n- `Linux 2401577586898b3590db80f8b97a26f81f0f6d4e`\n- `Linux >= 3.10.48 < 3.11`\n- `Linux >= 3.12.24 < 3.13`\n- `Linux 3.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}