CVE-2026-93042 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: dw-edma: Terminate all descriptors without callbacks
The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst:
"No callback functions will be called for any incomplete transfers."
dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak.
Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks.
A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel's dw-edma DMA engine driver stems from a deviation between documented API behavior and actual implementation regarding descriptor termination. According to the dmaengine client documentation, specifically within the Terminate APIs section of Documentation/driver-api/dmaengine/client.rst, it is explicitly stated that no callback functions should be invoked for any incomplete transfers when termination operations are initiated. However, the dw-edma driver historically violated this contract by invoking vchan_cookie_complete() upon receiving a deferred STOP interrupt. This action triggered callbacks for active descriptors while leaving other issued or submitted descriptors in a queued state rather than properly terminating them. This inconsistency creates a dangerous operational environment where the kernel's expectation of clean resource management is not met, leading to potential memory safety violations and undefined behavior during DMA operations.
The primary technical flaw lies in how incomplete transfers are handled when termination commands such as dmaengine_terminate_sync() are executed. By calling vchan_cookie_complete(), the driver schedules callbacks for descriptors that have not completed their transfer successfully. This results in late callback execution occurring after the client state associated with those descriptors may have already been freed by the user space or higher-level kernel subsystems. Dereferencing this freed memory leads to use-after-free vulnerabilities, which can cause kernel panics, data corruption, or potentially allow an attacker to execute arbitrary code if they can control the contents of the freed memory region. Furthermore, leaving other descriptors in a queued state allows them to be inadvertently restarted later using reused buffers, leading to buffer overflows or information leaks as old data is written into newly allocated memory spaces without proper synchronization.
From a security and standards perspective, this vulnerability aligns with CWE-416, Use After Free, due to the potential for dereferencing freed client state through late callbacks. It also relates to CWE-787, Out-of-bounds Write, if leftover descriptors restart into reused buffers that are smaller than expected or contain sensitive data from previous allocations. In terms of the MITRE ATT&CK framework, this flaw could be leveraged in techniques associated with Defense Evasion by hiding malicious activity within DMA operations or Impact via Data Destruction and System Availability through kernel crashes caused by memory corruption. The failure to properly synchronize termination across all descriptors represents a significant gap in resource lifecycle management that undermines the integrity of the DMA subsystem.
The resolution involves restructuring how descriptors are managed during termination sequences. All issued and submitted descriptors must now be moved to the terminated list whenever termination completes, ensuring no active or pending operations remain unhandled. For pending STOP commands, this cleanup is performed from both the DONE and ABORT interrupt paths to guarantee comprehensive coverage regardless of how the transfer ends. Crucially, cookies for these descriptors are completed in order without scheduling any callbacks, thereby adhering strictly to the dmaengine API contract that prohibits callback invocation for incomplete transfers. This change eliminates the risk of late dereferences against freed memory structures by ensuring no asynchronous work is scheduled post-termination.
Additionally, the fix addresses timing issues related to pending STOP operations that may remain active until a running transfer raises an interrupt. The device_synchronize() function has been updated to wait for such pending stops to complete before releasing terminated descriptors, preventing race conditions where resources might be freed while still in use. This synchronization is implemented using sleep-based waiting rather than busy-polling to optimize CPU usage and reduce latency spikes during cleanup operations. A warning mechanism is included to alert developers if the existing timeout expires, indicating potential hardware or driver issues that require investigation. Finally, free_chan_resources() now reuses this synchronized termination logic before releasing remaining virt-dma resources, ensuring a clean and safe teardown of all DMA channel state.