CVE-2026-93042: dmaengine: dw-edma: Terminate all descriptors without callbacks
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: dw-edma: Terminate all descriptors without callbacks
The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst:
"No callback functions will be called for any incomplete transfers."
dw-edma instead calls vchancookiecomplete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengineterminatesync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak.
Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks.
A STOP can remain pending until the running transfer raises an interrupt. Make devicesynchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from freechanresources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel dw-edma DMA engine driver are exposed when clients terminate DMA transfers. The issue concerns active, issued, or submitted descriptors during termination.
What condition triggers the unsafe behavior?
The problematic path occurs when a deferred STOP reaches the interrupt handler. In that case, the driver can invoke a completion callback for the active descriptor after dmaengine_terminate_sync(), while other descriptors remain queued.
What could indicate that a system has been affected?
Relevant symptoms include a late DMA completion callback dereferencing client state that has already been freed. Remaining queued descriptors can also later restart using reused buffers or cause resource leakage.
Is there a mitigation if the corrected driver behavior is not available?
The provided information does not specify a configuration workaround. The correction requires termination to move all issued and submitted descriptors to the terminated list, complete cookies without callbacks, and wait for a pending STOP before releasing terminated descriptors.