CVE-2026-93041: dmaengine: dw-edma: Serialize abort state updates
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: dw-edma: Serialize abort state updates
dwedmaabortinterrupt() drops vc.lock before changing request and status. issuepending() can acquire the lock in that small window, observe the old busy state, and skip starting queued descriptors. Then the abort handler overwrites the channel status as idle, leaving the new descriptors stranded for good.
Keep descriptor completion and the state transition in the same critical section.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel and using the dw-edma DMA engine are relevant. The race is triggered when an abort interrupt occurs while queued descriptors may be started.
What is the operational impact if the race occurs?
Queued DMA descriptors can be skipped and then left stranded indefinitely. The channel can be marked idle even though the newly queued work was not started.
How can I recognize the affected behavior?
Affected behavior is indicated by queued dw-edma descriptors that do not start after an abort event and remain pending indefinitely. The condition results from the abort handler and pending-work processing observing and updating channel state out of order.