Cloudanix VulnDB

CVE-2026-98324

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux kernel DMA handling for certain hardware can let a local user corrupt memory, potentially crashing the system or gaining higher privileges.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Double counting of nb_desc in pxad_alloc_desc() after conversion to kzalloc_flex() causes incorrect descriptor counts passed to pxad_free_desc() and set_updater_desc(), resulting in memory corruption via invalid indexing or freeing of unallocated entries.

Why it matters to the business

Local memory corruption on Linux systems using PXA DMA engine can lead to kernel crashes, denial of service, or local privilege escalation; low exploitation likelihood reduces immediate urgency but still requires patching in affected kernels.

How an attack unfolds

A local attacker allocates PXA DMA descriptors, triggering the flawed allocation path where the counted-by field is set by the allocator but then incremented again in the loop; subsequent use in free or update paths indexes beyond allocated memory or frees invalid entries, enabling corruption.

How to fix it

Update to a kernel containing the fix that explicitly sets nb_desc and removes the erroneous increment; rebuild and deploy the corrected kernel image; verify with source inspection for the pxad_alloc_desc change.

How to confirm the fix worked

Inspect kernel source for pxad_alloc_desc to confirm explicit nb_desc assignment without post-allocation increment; boot test on PXA hardware exercising DMA paths and monitor for descriptor-related panics.

Typical attack path

  1. Obtain local code execution on affected Linux system
  2. Trigger DMA descriptor allocation via pxa engine usage
  3. Cause double-increment of nb_desc leading to invalid count
  4. Invoke free or update operations that act on the corrupted count
  5. Achieve out-of-bounds access or invalid free for memory corruption

How to detect it

Search kernel logs for PXA DMA allocation or descriptor errors; examine crash dumps for pxad_free_desc or set_updater_desc stack frames showing invalid counts; no widespread exploitation indicators reported.

What your security team should do

  • Prioritize kernel upgrade for any PXA DMA-using systems within standard patch cycles
  • Review custom kernels or out-of-tree PXA drivers for similar counted-by patterns
  • Monitor for upstream stable backports of the descriptor counting fix

The record

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was converted from kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT) to kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc itself - but only where the compiler has __builtin_counted_by_ref(), so from gcc 15.1 or clang 22.1 on. The loop below it still increments nb_desc, which makes it come out doubled there and correct elsewhere. nb_desc is what pxad_free_desc() iterates over and what set_updater_desc() indexes from, so set it explicitly and drop the increment. The error path has to lower it to the number of descriptors allocated so far, otherwise pxad_free_desc() would free entries that were never allocated.

Affected packages

Ecosystem Package Introduced Fixed