LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52456: serial: imx: fix tx statemachine deadlock

In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2023-52456 is a Linux kernel issue in the i.MX serial driver when used for RS485. If a user-space program closes or crashes during transmission, the serial transmit state machine can deadlock, leaving the RS485 interface unusable until recovery.

Executive priority

Treat as targeted operational-risk remediation for embedded or industrial fleets, not a broad enterprise emergency. Prioritize assets where RS485 controls production, safety-adjacent, or field equipment availability.

Technical view

The imx UART RS485 transmit state machine controls RTS/TX_EN. During shutdown, Transmission Complete interrupts can be disabled while transmission is incomplete. The old stop path waited for an interrupt that could no longer arrive, leaving the state in SEND. The fix changes stop_tx handling so the state machine reaches WAIT_AFTER_SEND.

Likely exposure

Exposure is most relevant to embedded or industrial Linux systems using NXP/Freescale i.MX UARTs in RS485 mode. General-purpose Linux servers without this hardware and RS485 configuration are unlikely to be affected.

Exploitation context

The bundle does not show KEV listing, active exploitation, CVSS scoring, or public exploit evidence. The described impact is availability of an RS485 interface after an interrupted transmission, not remote code execution or privilege escalation.

Researcher notes

Evidence is limited to the Linux kernel fix description, stable commit references, and Debian LTS advisory. No CWE, CVSS, or exploit details are provided in the bundle. Avoid broad claims beyond i.MX RS485 serial availability impact.

Mitigation direction

  • Identify systems using Linux i.MX UART serial ports in RS485 mode.
  • Update affected kernels to vendor or stable releases containing the listed kernel fixes.
  • Check Debian LTS guidance if running Debian-packaged kernels.
  • If patching is delayed, reduce service crash risk for RS485 user-space applications.

Validation and detection

  • Inventory kernel versions and hardware for i.MX UART RS485 usage.
  • Confirm the running kernel includes one of the referenced stable commits or vendor backports.
  • Review logs for serial or RS485 failures after application crashes or port closes.
  • Test RS485 recovery behavior after controlled application termination in a lab.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52456 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcb1a609236096c278ecbfb7be678a693a70283f1, cb1a609236096c278ecbfb7be678a693a70283f1, cb1a609236096c278ecbfb7be678a693a70283f1, cb1a609236096c278ecbfb7be678a693a70283f1, cb1a609236096c278ecbfb7be678a693a70283f1, cb1a609236096c278ecbfb7be678a693a70283f1unaffected
LinuxLinux5.9, 0, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.