CVE-2026-89994 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: fsl-edma: tracing: no ptr dereference during log output
The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid.
Event injection can be used to trigger a crash:
$ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace
The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
This vulnerability represents a classic Use-After-Free scenario within the Linux kernel's DMA engine subsystem, specifically affecting the Freescale eDMA driver. The core technical flaw lies in how trace events are handled during device lifecycle transitions. When an fsl_edma event is recorded for tracing purposes, it stores a direct pointer to the struct fsl_edma_engine structure within its ringbuffer data. This design assumes that the target object will remain valid until the trace entry is subsequently read and printed by userspace tools or kernel loggers. However, this assumption fails when the underlying device is removed or suspended while trace entries are still pending in the buffer but have not yet been consumed. In such scenarios, the memory associated with the fsl_edma_engine structure may be freed or unmapped before the tracing subsystem attempts to dereference it for output. This race condition between resource deallocation and asynchronous log processing leads to a kernel panic or system crash due to an invalid memory access.
The operational impact of this vulnerability is significant, primarily affecting system stability rather than data confidentiality or integrity in most standard configurations. An attacker with local access who can trigger device removal events while tracing is active could induce a denial-of-service condition by crashing the entire operating system. The specific exploit path involves interacting with the debugfs interface to inject trace events and then forcing the consumption of those entries after the associated hardware context has been invalidated. This highlights a broader class of issues in kernel debugging infrastructure where performance optimizations or simplified data structures inadvertently introduce safety violations during edge cases involving device hot-plugging, driver unbinding, or system suspend/resume cycles.
From a classification perspective, this flaw aligns with CWE-416: Use After Free, as the code attempts to access memory through a pointer that has become invalid due to prior deallocation. It also relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, given the race condition between the driver's cleanup routines and the tracing subsystem's read operations. In terms of MITRE ATT&CK mapping for Linux systems, this vulnerability could be leveraged in techniques related to System Discovery or Defense Evasion if an attacker uses it to disrupt logging mechanisms, though its primary classification remains a stability issue exploitable via local privilege escalation paths that lead to system crashes.
The resolution implemented by the kernel maintainers addresses this flaw through a defensive data structuring approach rather than complex locking mechanisms. Instead of storing a raw pointer to the fsl_edma_engine structure in every trace event, which creates a dependency on the object's lifetime extending beyond its logical scope, the fix introduces a dedicated membase field directly into the event payload at the time of recording. This field captures the necessary memory base address value as an integer or static data point that remains valid even if the parent engine structure is later freed. By decoupling the trace log output from the live object reference, the vulnerability is eliminated without requiring changes to existing userspace tools, ensuring backward compatibility while restoring system stability during device lifecycle events.