CVE-2026-93041

dmaengine: dw-edma: Serialize abort state updates

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: dw-edma: Serialize abort state updates

dw_edma_abort_interrupt() drops vc.lock before changing request and
status. issue_pending() can acquire the lock in that small window,
observe the old busy state, and skip starting queued descriptors. Then
the abort handler overwrites the channel status as idle, leaving the new
descriptors stranded for good.

Keep descriptor completion and the state transition in the same critical
section.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< 4a72f81b8681b2ad7705cf039974c443dcc8ff00
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< b7b8b08cd6422f7ed783226ac4aa6cebe398ab54
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< 0b028e5175590fb34ccbd537ff5b9cd386ce5747
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< 075de95d7a7cd8fecfb6fe1c685c9064fc6c9d76
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< e20c6539394ac8d70240b85bb5963c74a3a49789
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< 0c3294066c36d5980fd9c8192dcb53bb9ccd1f7b
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< f71c94c1a657492e015be227d44c4198a8e7a91d
`e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf`	affected	< dd80e259f65d932634e26d366570d71669ef6654

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,4a72f81b8681b2ad7705cf039974c443dcc8ff00)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,b7b8b08cd6422f7ed783226ac4aa6cebe398ab54)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,0b028e5175590fb34ccbd537ff5b9cd386ce5747)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,075de95d7a7cd8fecfb6fe1c685c9064fc6c9d76)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,e20c6539394ac8d70240b85bb5963c74a3a49789)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,0c3294066c36d5980fd9c8192dcb53bb9ccd1f7b)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,f71c94c1a657492e015be227d44c4198a8e7a91d)`	affected	code_commit	—
`[e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf,dd80e259f65d932634e26d366570d71669ef6654)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.220% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/075de95d7a7cd8fecfb6fe1c685c9064fc6c9d76
https://git.kernel.org/stable/c/0b028e5175590fb34ccbd537ff5b9cd386ce5747
https://git.kernel.org/stable/c/0c3294066c36d5980fd9c8192dcb53bb9ccd1f7b
https://git.kernel.org/stable/c/4a72f81b8681b2ad7705cf039974c443dcc8ff00
https://git.kernel.org/stable/c/b7b8b08cd6422f7ed783226ac4aa6cebe398ab54
https://git.kernel.org/stable/c/dd80e259f65d932634e26d366570d71669ef6654
https://git.kernel.org/stable/c/e20c6539394ac8d70240b85bb5963c74a3a49789
https://git.kernel.org/stable/c/f71c94c1a657492e015be227d44c4198a8e7a91d

History

Sep 19, 2026 6:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-368

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dw_edma_abort_interrupt() drops vc.lock before changing request and status. issue_pending() can acquire the lock in that small window, observe the old busy state, and skip starting queued descriptors. Then the abort handler overwrites the channel status as idle, leaving the new descriptors stranded for good. Keep descriptor completion and the state transition in the same critical section.
Title		dmaengine: dw-edma: Serialize abort state updates
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/075de95d7a7cd8fecfb6fe1c685c9064fc6c9d76 https://git.kernel.org/stable/c/0b028e5175590fb34ccbd537ff5b9cd386ce5747 https://git.kernel.org/stable/c/0c3294066c36d5980fd9c8192dcb53bb9ccd1f7b https://git.kernel.org/stable/c/4a72f81b8681b2ad7705cf039974c443dcc8ff00 https://git.kernel.org/stable/c/b7b8b08cd6422f7ed783226ac4aa6cebe398ab54 https://git.kernel.org/stable/c/dd80e259f65d932634e26d366570d71669ef6654 https://git.kernel.org/stable/c/e20c6539394ac8d70240b85bb5963c74a3a49789 https://git.kernel.org/stable/c/f71c94c1a657492e015be227d44c4198a8e7a91d