CVE-2026-93170
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A bug in Linux kernel handling of certain hardware data transfers could let someone with local access corrupt information or crash the system.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in AXIDMA and MCDMA interrupt handlers allows a channel to be incorrectly marked idle while active_list still contains descriptors, leading to premature start_transfer calls, descriptor corruption, or missed completions.
Why it matters to the business
Local attackers on affected Linux systems using Xilinx DMA hardware can trigger data corruption or denial of service, increasing operational risk on embedded or high-performance devices; low exploit probability but high impact if triggered.
How an attack unfolds
An attacker with local access queues multiple descriptors, triggers interrupts after partial completion, and exploits the window where the handler marks the channel idle despite remaining work, causing spurious transfers and corruption.
How to fix it
Apply the upstream kernel fix that checks active_list emptiness before marking idle and starting new transfers; rebuild and deploy updated kernel images for all affected Xilinx DMA configurations.
How to confirm the fix worked
Confirm the patch is present by inspecting the interrupt handler logic for the active_list emptiness check before idle marking; test with multi-descriptor workloads under interrupt load to verify no spurious transfers occur.
Typical attack path
- Obtain local code execution on a Linux system using Xilinx AXIDMA or MCDMA
- Queue multiple active DMA descriptors
- Force or wait for an interrupt after partial descriptor completion
- Trigger the flawed idle-state logic to initiate invalid transfers
- Observe or induce descriptor corruption or missed completions
How to detect it
Search kernel logs for repeated spurious transfer attempts or descriptor errors following interrupt handling in xilinx_dma; review dmesg and system logs around DMA channel state transitions for anomalies indicating premature idle marking.
What your security team should do
- Prioritize kernel updates on systems using Xilinx DMA engines
- Monitor upstream dmaengine/xilinx_dma commits for backports to supported LTS kernels
- Restrict local access on high-value embedded platforms until patched
- Review DMA usage in custom drivers for similar state-management patterns
The record
In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious transfers when descriptors are still being processed. The issue occurs when: 1. Multiple descriptors are queued and active. 2. An interrupt fires after completing some descriptors. 3. xilinx_dma_complete_descriptor() moves completed descriptors to done_list. 4. Channel is marked idle and start_transfer() is called even though active_list still contains unprocessed descriptors. 5. This leads to premature transfer attempts and potential descriptor corruption or missed completions. Only mark the channel as idle and start new transfers when the active list is actually empty, ensuring proper channel state management and avoiding spurious transfer attempts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|