CVE-2026-98324: dmaengine: pxa: fix double counting of the hw descriptors
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: pxa: fix double counting of the hw descriptors
pxadallocdesc() was converted from
kzalloc(structsize(swdesc, hwdesc, nbhwdesc), GFPNOWAIT)
to kzallocflex(), which sets the countedby() counter swdesc->nbdesc itself - but only where the compiler has builtincountedbyref(), so from gcc 15.1 or clang 22.1 on. The loop below it still increments nbdesc, which makes it come out doubled there and correct elsewhere.
nbdesc is what pxadfreedesc() iterates over and what setupdaterdesc() indexes from, so set it explicitly and drop the increment. The error path has to lower it to the number of descriptors allocated so far, otherwise pxadfreedesc() would free entries that were never allocated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which build environments are affected by the descriptor-counting issue?
The issue occurs when the code is built with GCC 15.1 or later or Clang 22.1 or later, where __builtin_counted_by_ref() is available and kzalloc_flex() sets the counted-by counter automatically. The subsequent loop then increments the counter again, doubling its value.
What kernel operations use the incorrect descriptor count?
pxad_free_desc() iterates using nb_desc, and set_updater_desc() indexes descriptors using that value. A doubled count can therefore cause these operations to act on an incorrect number of hardware descriptor entries.
Why does allocation failure matter for this issue?
On an allocation error path, nb_desc must be reduced to the number of descriptors allocated so far. Otherwise, pxad_free_desc() can attempt to free descriptor entries that were never allocated.