CVE-2026-93170: dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious transfers when descriptors are still being processed.
The issue occurs when: 1. Multiple descriptors are queued and active. 2. An interrupt fires after completing some descriptors. 3. xilinxdmacompletedescriptor() moves completed descriptors to donelist. 4. Channel is marked idle and starttransfer() is called even though activelist still contains unprocessed descriptors. 5. This leads to premature transfer attempts and potential descriptor corruption or missed completions.
Only mark the channel as idle and start new transfers when the active list is actually empty, ensuring proper channel state management and avoiding spurious transfer attempts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel resolution for the race condition in AXIDMA and MCDMA irq handlers: ensure the channel is marked idle and start_transfer() is called only when active_list still contains unprocessed descriptors is false (i.e., active_list is empty), so spurious transfer attempts and descriptor corruption/missed completions are avoided.
Linux kernel (dmaengine: xilinx_dma) AXIDMA/MCDMA channel idle state management in interrupt handlers = Update logic to only mark channel idle and call start_transfer() when active_list is empty (done_list moved via xilinx_dma_complete_descriptor()).
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's Xilinx AXIDMA or MCDMA DMA engine drivers are affected when they have multiple descriptors queued and active. The race is triggered during interrupt handling after only some queued descriptors have completed.
What operational impact can occur if the race is triggered?
The driver can mark a channel idle while unprocessed descriptors remain on its active list, then start transfers prematurely. This can cause spurious transfer attempts, descriptor corruption, or missed completions.
How can you determine whether the vulnerable condition is occurring?
The described condition requires multiple active queued descriptors and an interrupt that completes only part of that queue. Observable symptoms may include spurious DMA transfer attempts, corrupted descriptors, or missed DMA completions.