Cloudanix VulnDB

CVE-2026-93041

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem inside the Linux kernel can cause certain hardware data transfers to get stuck and never finish.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in dw_edma_abort_interrupt allows it to drop vc.lock before updating request and status; concurrent issue_pending can observe stale busy state, skip queued work, and leave the channel marked idle with descriptors stranded.

Why it matters to the business

DMA operations on affected systems may silently stall, causing data-transfer failures, resource leaks, or application hangs in storage, networking, or other DMA-using subsystems.

How an attack unfolds

An attacker with local code execution crafts DMA requests and triggers abort paths while issue_pending runs, racing the lock release to strand descriptors and degrade channel availability.

How to fix it

Update to a Linux kernel containing the fix that keeps descriptor completion and state transition inside the same critical section under vc.lock.

How to confirm the fix worked

Confirm the kernel source contains the serialized abort handling change; run DMA stress tests that exercise abort and issue_pending concurrently and verify no descriptors are left stranded.

Typical attack path

  1. Obtain local execution on a Linux system using dw-edma
  2. Allocate DMA channels and submit descriptors
  3. Trigger abort interrupts while issue_pending is active
  4. Observe stranded descriptors and channel left idle

How to detect it

Review kernel logs for dw-edma abort and issue_pending activity; look for DMA channel state inconsistencies or hung descriptor queues after abort events.

What your security team should do

  • Prioritize kernel updates on systems using dw-edma hardware
  • Monitor vendor advisories for backported fixes
  • Limit untrusted local code execution until patched

The record

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dw_edma_abort_interrupt() drops vc.lock before changing request and status. issue_pending() can acquire the lock in that small window, observe the old busy state, and skip starting queued descriptors. Then the abort handler overwrites the channel status as idle, leaving the new descriptors stranded for good. Keep descriptor completion and the state transition in the same critical section.

Affected packages

Ecosystem Package Introduced Fixed