CVE-2026-93042: Linux Vulnerability (CVSS 8.8)

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for any incomplete transfers." dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak. Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks. A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < 65e387b95d3855aa894ac729e1778e5bcb9083cb; >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < 4793f9099a1cadf4e37f3a03d524af6bce88a0ea; >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < be87d86537de7ea6fd025f41033d2faff880973f; >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7; >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < 99109a51efd28c9a661fbfb9469b023c517b31d1
Linux	Linux	5.3

References

Timeline

Published: Sep 17, 2026
Last Modified: Sep 18, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-93042?

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Terminate all descriptors without callbacks The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for any incomplete transfers." dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak. Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks. A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires.

How severe is CVE-2026-93042?

CVE-2026-93042 has a CVSS score of 8.8/10 (HIGH severity).

How do I fix CVE-2026-93042?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →