CVE-2026-93042: dmaengine: dw-edma: Terminate all descriptors without callbacks
dmaengine: dw-edma: Terminate all descriptors without callbacks
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update dmaengine dw-edma termination handling so deferred STOP completion terminates all issued and submitted descriptors without scheduling callbacks: complete cookies in order without callbacks from both DONE and ABORT paths, move descriptors to the terminated list when termination completes, and make device_synchronize() wait for pending STOP completion before releasing terminated descriptors.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel dw-edma DMA engine driver are exposed when clients terminate DMA transfers. The issue concerns active, issued, or submitted descriptors during termination.
What condition triggers the unsafe behavior?
The problematic path occurs when a deferred STOP reaches the interrupt handler. In that case, the driver can invoke a completion callback for the active descriptor after dmaengine_terminate_sync(), while other descriptors remain queued.
What could indicate that a system has been affected?
Relevant symptoms include a late DMA completion callback dereferencing client state that has already been freed. Remaining queued descriptors can also later restart using reused buffers or cause resource leakage.
Is there a mitigation if the corrected driver behavior is not available?
The provided information does not specify a configuration workaround. The correction requires termination to move all issued and submitted descriptors to the terminated list, complete cookies without callbacks, and wait for a pending STOP before releasing terminated descriptors.