dmaengine: dw-edma: Terminate all descriptors without callbacks

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-93042
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-17 17:17:57 UTC
Updated2026-09-17 17:17:57 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for any incomplete transfers." dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak. Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks. A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf 65e387b95d3855aa894ac729e1778e5bcb9083cb git Not specified
CNA Linux Linux affected e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf 4793f9099a1cadf4e37f3a03d524af6bce88a0ea git Not specified
CNA Linux Linux affected e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf be87d86537de7ea6fd025f41033d2faff880973f git Not specified
CNA Linux Linux affected e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7 git Not specified
CNA Linux Linux affected e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf 99109a51efd28c9a661fbfb9469b023c517b31d1 git Not specified
CNA Linux Linux affected 5.3 Not specified
CNA Linux Linux unaffected 5.3 semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/be87d86537de7ea6fd025f41033d2faff880973f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4793f9099a1cadf4e37f3a03d524af6bce88a0ea 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/65e387b95d3855aa894ac729e1778e5bcb9083cb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/99109a51efd28c9a661fbfb9469b023c517b31d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report