Linux Kernel up to 7.2.7/7.3-rc3 dmaengine pxad_alloc_desc nb_desc buffer size

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.7/7.3-rc3 and classified as very critical. Affected by this issue is the function pxad_alloc_desc of the component dmaengine. Executing a manipulation of the argument nb_desc can lead to buffer size. This vulnerability is registered as CVE-2026-98324. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.7/7.3-rc3. It has been declared as very critical. This vulnerability affects the function pxad_alloc_desc of the component dmaengine. The manipulation of the argument nb_desc with an unknown input leads to a buffer size vulnerability. The CWE definition for the vulnerability is CWE-131. The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was converted from kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT) to kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc itself - but only where the compiler has __builtin_counted_by_ref(), so from gcc 15.1 or clang 22.1 on. The loop below it still increments nb_desc, which makes it come out doubled there and correct elsewhere. nb_desc is what pxad_free_desc() iterates over and what set_updater_desc() indexes from, so set it explicitly and drop the increment. The error path has to lower it to the number of descriptors allocated so far, otherwise pxad_free_desc() would free entries that were never allocated.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-98324 since 09/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 10/06/2026).

Upgrading to version 7.2.8 or 7.3-rc4 eliminates this vulnerability. Applying the patch 1de93785f32b450e9eae1e4fcfb7d03eb49eb27e/f6504be006aa4bb4bd26285f410a885c17920d65 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion