CVE-2026-72146

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72146", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.908Z", "datePublished": "2026-08-15T05:53:18.431Z", "dateUpdated": "2026-08-19T16:36:26.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:26.048Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sh: rz-dmac: Move interrupt request after everything is set up\n\nOnce the interrupt is requested, the interrupt handler may run immediately.\nSince the IRQ handler can access channel->ch_base, which is initialized\nonly after requesting the IRQ, this may lead to invalid memory access.\nLikewise, the IRQ thread may access uninitialized data (the ld_free,\nld_queue, and ld_active lists), which may also lead to issues.\n\nRequest the interrupts only after everything is set up. To keep the error\npath simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw triggers in rz_dmac_chan_probe() during Renesas RZ/G2L/V2H/T2H platform DMAC driver initialization at boot or module load; there is no network, Bluetooth, or runtime syscall path to the vulnerable devm_request_threaded_irq() ordering.\nAC:L - Once the DMAC channel IRQ line is asserted when devm_request_threaded_irq() is called after reset_deassert, the hardirq/thread handlers run immediately before ch_base or lists are initialized; stale post-reset interrupt state on these SoCs makes this timing plausible without luck.\nPR:N - rz_dmac_probe() performs no capability or authentication checks before requesting per-channel IRQs; on affected Renesas embedded boards the vulnerable probe sequence runs automatically during kernel boot without the attacker holding Linux privileges.\nUI:N - No victim action is required; pending/latched DMAC channel interrupts during driver probe at boot or reboot can invoke the buggy handlers without anyone opening device nodes or configuring DMA transfers.\nS:U - Impact is kernel NULL dereference, list/spinlock corruption, and MMIO faults within the host kernel; this is not a VM escape, container sandbox breakout, or documented IOMMU security-boundary bypass.\nC:H - The threaded IRQ handler may lock an uninitialized vc.lock and walk uninitialized ld_active/ld_queue/ld_free lists, causing invalid kernel memory reads and list-metadata exposure beyond a pure bounded fault.\nI:H - The hardirq path issues readl/writel through uninitialized ch_base (NULL/low MMIO), and list/spinlock corruption in the IRQ thread can corrupt kernel heap metadata and enable control-flow hijack primitives.\nA:H - Invalid MMIO via NULL ch_base and corrupted IRQ-thread list handling can cause kernel oops/panic during probe on affected embedded systems, causing full loss of availability until reboot."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/sh/rz-dmac.c"], "versions": [{"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "d24d53323e817d79a4bd111bd10b34dbc96e64a8", "status": "affected", "versionType": "git"}, {"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f", "status": "affected", "versionType": "git"}, {"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "5b12de6229d662864ee22c11d4876652b40120f0", "status": "affected", "versionType": "git"}, {"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93", "status": "affected", "versionType": "git"}, {"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "ec9f66c91bffdb69d309bae6dfb387562db7ebc8", "status": "affected", "versionType": "git"}, {"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "07ae600bd353b22f31a8f1007269744fafc7f123", "status": "affected", "versionType": "git"}, {"version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "lessThan": "731712403ddb39d1a76a11abf339a0615bc85de7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/sh/rz-dmac.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d24d53323e817d79a4bd111bd10b34dbc96e64a8"}, {"url": "https://git.kernel.org/stable/c/0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f"}, {"url": "https://git.kernel.org/stable/c/5b12de6229d662864ee22c11d4876652b40120f0"}, {"url": "https://git.kernel.org/stable/c/2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93"}, {"url": "https://git.kernel.org/stable/c/ec9f66c91bffdb69d309bae6dfb387562db7ebc8"}, {"url": "https://git.kernel.org/stable/c/07ae600bd353b22f31a8f1007269744fafc7f123"}, {"url": "https://git.kernel.org/stable/c/731712403ddb39d1a76a11abf339a0615bc85de7"}], "title": "dmaengine: sh: rz-dmac: Move interrupt request after everything is set up", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/sh/rz-dmac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d24d53323e817d79a4bd111bd10b34dbc96e64a8", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}, {"lessThan": "0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}, {"lessThan": "5b12de6229d662864ee22c11d4876652b40120f0", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}, {"lessThan": "2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}, {"lessThan": "ec9f66c91bffdb69d309bae6dfb387562db7ebc8", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}, {"lessThan": "07ae600bd353b22f31a8f1007269744fafc7f123", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}, {"lessThan": "731712403ddb39d1a76a11abf339a0615bc85de7", "status": "affected", "version": "5000d37042a61ca556fde2782ca40dbfa802ea16", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/sh/rz-dmac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sh: rz-dmac: Move interrupt request after everything is set up\n\nOnce the interrupt is requested, the interrupt handler may run immediately.\nSince the IRQ handler can access channel->ch_base, which is initialized\nonly after requesting the IRQ, this may lead to invalid memory access.\nLikewise, the IRQ thread may access uninitialized data (the ld_free,\nld_queue, and ld_active lists), which may also lead to issues.\n\nRequest the interrupts only after everything is set up. To keep the error\npath simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent()."}], "id": "CVE-2026-72146", "lastModified": "2026-08-19T17:21:00.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:32.267", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07ae600bd353b22f31a8f1007269744fafc7f123"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b12de6229d662864ee22c11d4876652b40120f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/731712403ddb39d1a76a11abf339a0615bc85de7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d24d53323e817d79a4bd111bd10b34dbc96e64a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec9f66c91bffdb69d309bae6dfb387562db7ebc8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up", "id": "2516283", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516283"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's dmaengine component. A race condition exists where an interrupt handler or thread may attempt to access uninitialized data structures immediately after an interrupt is requested but before proper initialization. This can lead to invalid memory access, potentially causing system instability or denial of service."], "name": "CVE-2026-72146", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72146\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72146\nhttps://lore.kernel.org/linux-cve-announce/2026081533-CVE-2026-72146-5f98@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5000d37042a61ca556fde2782ca40dbfa802ea16,5b12de6229d662864ee22c11d4876652b40120f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5000d37042a61ca556fde2782ca40dbfa802ea16,2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5000d37042a61ca556fde2782ca40dbfa802ea16,ec9f66c91bffdb69d309bae6dfb387562db7ebc8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5000d37042a61ca556fde2782ca40dbfa802ea16,07ae600bd353b22f31a8f1007269744fafc7f123)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5000d37042a61ca556fde2782ca40dbfa802ea16,731712403ddb39d1a76a11abf339a0615bc85de7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:15:03.365029+00:00", "updated": "2026-08-22T11:45:03.560969+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}