CVE-2025-71221: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: mmppdma: Fix race condition in mmppdmaresidue()
Add proper locking in mmppdmaresidue() to prevent use-after-free when accessing descriptor list and descriptor contents.
The race occurs when multiple threads call txstatus() while the tasklet on another CPU is freeing completed descriptors:
CPU 0 CPU 1 ----- ----- mmppdmatxstatus() mmppdmaresidue() -> NO LOCK held listforeachentry(sw, ..) DMA interrupt dmadotasklet() -> spinlock(&desclock) listmove(sw->node, ...) spinunlock(&desclock) | dmapoolfree(sw) <- FREED! -> access sw->desc <- UAF!
This issue can be reproduced when running dmatest on the same channel with multiple threads (threadsperchan > 1).
Fix by protecting the chainrunning list iteration and descriptor access with the chan->desclock spinlock.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71221?
CVE-2025-71221 has a medium severity rating due to a race condition that can lead to use-after-free issues.
How do I fix CVE-2025-71221?
To fix CVE-2025-71221, update your Linux kernel to a version that includes the patch for the mmp_pdma_residue() function.
What systems are affected by CVE-2025-71221?
CVE-2025-71221 affects the Linux kernel, specifically systems using the dmaengine and mmp_pdma drivers.
What is the nature of the vulnerability in CVE-2025-71221?
CVE-2025-71221 is a race condition vulnerability that may cause use-after-free errors when accessing descriptor lists.
Is there a workaround for CVE-2025-71221?
There is no specific workaround for CVE-2025-71221; the recommended action is to apply the kernel update.