CVE-2026-93170

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93170", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.090Z", "datePublished": "2026-09-17T16:12:01.249Z", "dateUpdated": "2026-10-19T09:06:41.936Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:06:41.936Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers\n\nFix a race condition in AXIDMA and MCDMA irq handlers where the channel\ncould be incorrectly marked as idle and attempt spurious transfers when\ndescriptors are still being processed.\n\nThe issue occurs when:\n1. Multiple descriptors are queued and active.\n2. An interrupt fires after completing some descriptors.\n3. xilinx_dma_complete_descriptor() moves completed descriptors to\ndone_list.\n4. Channel is marked idle and start_transfer() is called even though\n active_list still contains unprocessed descriptors.\n5. This leads to premature transfer attempts and potential descriptor\n corruption or missed completions.\n\nOnly mark the channel as idle and start new transfers when the active list\nis actually empty, ensuring proper channel state management and avoiding\nspurious transfer attempts."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in xilinx_dma_irq_handler() and xilinx_mcdma_irq_handler(), installed via request_irq() and invoked on AXI DMA IOC/delay status in DMASR (or MCDMA CHAN_SR). Those handlers operate on locally built BD lists after dmaengine_submit() from clients such as axienet_start_xmit_dmaengine()/axienet_rx_submit_desc(); they do not parse a remote protocol field.\nAC:L - xilinx_dma_complete_descriptor() breaks at the first AXIDMA SG BD lacking XILINX_DMA_BD_COMP_MASK, so a FRM_CNT_IRQ/DLY_CNT_IRQ mid-batch leaves active_list non-empty and the old code always sets chan->idle and calls start_transfer(). An attacker who floods submits (axienet TX, or desc_pendingcount > XILINX_DMA_COALESCE_MAX leaving stale coalesce) creates that mid-batch IRQ deterministically.\nPR:L - An unprivileged local user reaches the AXIDMA submit path without CAP_SYS_ADMIN: sending frames on an axienet interface (axienet_start_xmit_dmaengine \u2192 dmaengine_submit/issue_pending) or using an IIO dmaengine buffer. The kernel driver, not the user, calls dma_request_chan().\nUI:N - The attacker generates the multi-descriptor load and the completion IRQs themselves (their own packets or buffer I/O). No second user must mount media, open a victim file, or change configuration.\nS:U - chan->idle, active_list, and the pre-linked seg_v BD pool are kernel dmaengine state. A spurious CURDESC/TAILDESC update corrupts those kernel buffers and client SKBs/pages under the same kernel authority; it is not a VM, IOMMU, or sandbox escape.\nC:H - xilinx_dma_start_transfer() writes TAILDESC while remaining active_list BDs are still in flight. alloc_chan_resources() pre-links seg_v into a 512-entry circular next_desc ring, so the engine can walk into BDs already moved to done_list and recycled by xilinx_dma_chan_desc_cleanup(), DMA-reading leftover SKB/kernel pages.\nI:H - The same premature start_transfer() plus circular next_desc walk lets MM2S/S2MM continue through BDs that xilinx_dma_clean_hw_desc() zeroed or that the tasklet reused for a new transfer, so the engine DMA-writes into freed or wrong buffers \u2014 kernel memory corruption and a control-flow hijack primitive.\nA:H - Setting chan->idle and calling start_transfer() while active_list still holds uncompleted AXIDMA BDs causes missed completions, SG decode/halt errors (chan->err in xilinx_dma_start()), and DMA into recycled descriptors that oops or permanently stall the channel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/xilinx/xilinx_dma.c"], "versions": [{"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "7f4b989d7d87381927b98d64492f8dcf979f57ab", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "5459e02707b27a964ae72e028d3ff72a3b687c4a", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "425630e9eea1f9f8912b8c6abf01e0dab1e27917", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "fdaf297ab275c6efecac5e87669c31bc89b74297", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "c27d16fd2358b2fc3e1ffaca03afd11dc28630ea", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "ec927657524be4438447944a58173c7baf7f2384", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "c3e943490ced0b9ad475844eda7661f6a9bcfb4a", "status": "affected", "versionType": "git"}, {"version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "lessThan": "0b6d055edb55ecadadf54e930c2b4fab76fa9a5a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/xilinx/xilinx_dma.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7f4b989d7d87381927b98d64492f8dcf979f57ab"}, {"url": "https://git.kernel.org/stable/c/5459e02707b27a964ae72e028d3ff72a3b687c4a"}, {"url": "https://git.kernel.org/stable/c/425630e9eea1f9f8912b8c6abf01e0dab1e27917"}, {"url": "https://git.kernel.org/stable/c/fdaf297ab275c6efecac5e87669c31bc89b74297"}, {"url": "https://git.kernel.org/stable/c/c27d16fd2358b2fc3e1ffaca03afd11dc28630ea"}, {"url": "https://git.kernel.org/stable/c/ec927657524be4438447944a58173c7baf7f2384"}, {"url": "https://git.kernel.org/stable/c/c3e943490ced0b9ad475844eda7661f6a9bcfb4a"}, {"url": "https://git.kernel.org/stable/c/0b6d055edb55ecadadf54e930c2b4fab76fa9a5a"}], "title": "dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/xilinx/xilinx_dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7f4b989d7d87381927b98d64492f8dcf979f57ab", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "5459e02707b27a964ae72e028d3ff72a3b687c4a", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "425630e9eea1f9f8912b8c6abf01e0dab1e27917", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "fdaf297ab275c6efecac5e87669c31bc89b74297", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "c27d16fd2358b2fc3e1ffaca03afd11dc28630ea", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "ec927657524be4438447944a58173c7baf7f2384", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "c3e943490ced0b9ad475844eda7661f6a9bcfb4a", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}, {"lessThan": "0b6d055edb55ecadadf54e930c2b4fab76fa9a5a", "status": "affected", "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/xilinx/xilinx_dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers\n\nFix a race condition in AXIDMA and MCDMA irq handlers where the channel\ncould be incorrectly marked as idle and attempt spurious transfers when\ndescriptors are still being processed.\n\nThe issue occurs when:\n1. Multiple descriptors are queued and active.\n2. An interrupt fires after completing some descriptors.\n3. xilinx_dma_complete_descriptor() moves completed descriptors to\ndone_list.\n4. Channel is marked idle and start_transfer() is called even though\n active_list still contains unprocessed descriptors.\n5. This leads to premature transfer attempts and potential descriptor\n corruption or missed completions.\n\nOnly mark the channel as idle and start new transfers when the active list\nis actually empty, ensuring proper channel state management and avoiding\nspurious transfer attempts."}], "id": "CVE-2026-93170", "lastModified": "2026-10-19T10:17:07.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:18:12.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b6d055edb55ecadadf54e930c2b4fab76fa9a5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/425630e9eea1f9f8912b8c6abf01e0dab1e27917"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5459e02707b27a964ae72e028d3ff72a3b687c4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f4b989d7d87381927b98d64492f8dcf979f57ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c27d16fd2358b2fc3e1ffaca03afd11dc28630ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3e943490ced0b9ad475844eda7661f6a9bcfb4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec927657524be4438447944a58173c7baf7f2384"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdaf297ab275c6efecac5e87669c31bc89b74297"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,7f4b989d7d87381927b98d64492f8dcf979f57ab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,5459e02707b27a964ae72e028d3ff72a3b687c4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,425630e9eea1f9f8912b8c6abf01e0dab1e27917)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,fdaf297ab275c6efecac5e87669c31bc89b74297)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,c27d16fd2358b2fc3e1ffaca03afd11dc28630ea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,ec927657524be4438447944a58173c7baf7f2384)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,c3e943490ced0b9ad475844eda7661f6a9bcfb4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,0b6d055edb55ecadadf54e930c2b4fab76fa9a5a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.270,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.221,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.188,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-19T07:45:06.232070+00:00", "updated": "2026-09-20T05:00:11.696679+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362"]}