Cloudanix VulnDB

CVE-2026-93169

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux handling of certain hardware could make the system crash when the driver is removed, fixed by reordering a few power-management steps.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in zynqmp_dma_remove allows runtime PM transitions to interleave with manual suspend and state checks during unbind, leaving the device in an inconsistent power-managed state.

Why it matters to the business

May trigger kernel crashes or undefined behavior on systems using ZynqMP DMA controllers during driver unload or hot-unplug, increasing downtime risk on affected embedded and industrial Linux deployments.

How an attack unfolds

Local attacker triggers concurrent runtime PM activity while unbinding the driver (rmmod or device removal), racing the original check-suspend-disable sequence to induce state corruption or a crash.

How to fix it

Update the Linux kernel to a version containing the corrected zynqmp_dma_remove logic that disables runtime PM before any suspend decision.

How to confirm the fix worked

Inspect zynqmp_dma.c for the revised remove function ordering; perform repeated bind/unbind cycles under runtime PM load to confirm stability.

Typical attack path

  1. Obtain local code execution or shell on target system
  2. Invoke driver unbind or module removal while runtime PM is active
  3. Trigger kernel fault or panic via the unsynchronized PM state change

How to detect it

Search kernel logs and crash dumps for oops/panic entries referencing zynqmp_dma during module unload or device removal events.

What your security team should do

  • Prioritize kernel updates on all ZynqMP-based systems
  • Restrict unprivileged local access until patches are applied
  • Include DMA driver removal events in crash and audit monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmp_dma: fix race between runtime PM and device removal In zynqmp_dma_remove(), runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind (rmmod) path. Disable runtime PM first, then suspend only if the device is not already suspended. To prevent any further runtime PM transitions.

Affected packages

Ecosystem Package Introduced Fixed