{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-93042", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-93042" ], "published": "2026-09-17T16:10:40Z", "summary": "dmaengine: dw-edma: Terminate all descriptors without callbacks", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: Terminate all descriptors without callbacks\n\nThe DMA Engine client documentation says in the \"Terminate APIs\" section\nof Documentation/driver-api/dmaengine/client.rst:\n\n\"No callback functions will be called for any incomplete transfers.\"\n\ndw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches\nthe interrupt handler. This schedules a callback for the active descriptor\nand leaves other issued or submitted descriptors queued. A late callback\nafter dmaengine_terminate_sync() can dereference client state that has\nalready been freed, while leftover descriptors may later restart into\nreused buffers or leak.\n\nMove all issued and submitted descriptors to the terminated list whenever\ntermination completes. For a pending STOP, do this from both the DONE and\nABORT paths. Complete their cookies in order without scheduling callbacks.\n\nA STOP can remain pending until the running transfer raises an\ninterrupt. Make device_synchronize() wait for such a pending STOP to\ncomplete before releasing terminated descriptors. Reuse it from\nfree_chan_resources(), then release the remaining virt-dma resources.\nSleep instead of busy-polling while waiting, and warn if the existing\ntimeout expires.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null, "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93042" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/65e387b95d3855aa894ac729e1778e5bcb9083cb" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4793f9099a1cadf4e37f3a03d524af6bce88a0ea" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/be87d86537de7ea6fd025f41033d2faff880973f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/99109a51efd28c9a661fbfb9469b023c517b31d1" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-18T17:55:42Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.8, "cvss_v3_severity": "High", "scenario": "AV:A - On DesignWare PCIe endpoint SoCs the host starts eDMA via pci_epf_mhi_edma_read()/write() (MHI transfers \u22654K), nvmet_pci_epf_dma_transfer(), or pci_epf_test BAR COMMAND_READ|WRITE with FLAG_USE_DMA, then those clients call dmaengine_terminate_sync() on the local dw-edma channel; the trigger is PCIe-link peer traffic, not a local syscall or a routable protocol.\nAC:L - pci_epf_mhi_edma_read() waits only 1000ms then calls dmaengine_terminate_sync(); a host that issues a \u22654K MHI DMA and stalls it hits that timeout while EDMA_ST_BUSY. Vulnerable dw_edma_device_terminate_all() only stores EDMA_REQ_STOP and returns 0 because device_synchronize was unimplemented, so the host can drop the stall and deliver the DONE/ABORT IRQ itself.\nPR:N - pci_epf_mhi_edma_read()/write() and nvmet_pci_epf_dma_transfer() do not authenticate the PCIe host; MHI TREs, NVMe I/O, or BAR command-register COMMAND_READ/WRITE writes from the upstream port suffice, with no Linux uid, capability, or user-namespace check on the endpoint.\nUI:N - The PCIe host starts the MHI/NVMe/epf-test DMA and forces the client's terminate-on-timeout path itself; no victim mount, file open, or other interactive step is required once the endpoint function is already bound.\nS:U - The late vchan_complete() callback UAF and leftover desc_issued restarts corrupt callback state and DMA buffers inside the same endpoint kernel that hosts dw-edma; that is in-kernel memory corruption, not a KVM/Xen guest escape or an IOMMU policy bypass.\nC:H - dw_edma_done_interrupt()'s EDMA_REQ_STOP path calls vchan_cookie_complete(), so vchan_complete() can invoke pci_epf_mhi_dma_callback() after pci_epf_mhi_edma_read() returned and its DECLARE_COMPLETION_ONSTACK died; leftover issued descriptors can also dw_edma_start_transfer() MEM_TO_DEV from reused kernel pages into host memory.\nI:H - After dma_unmap_single() in the MHI/nvmet timeout path, leftover desc_issued entries stay queued, so a later issue_pending() runs dw_edma_start_transfer() DEV_TO_MEM into those unmapped/reused pages, and the late callback UAF likewise corrupts kernel state, giving a write primitive.\nA:H - The STOP-path vchan_cookie_complete() UAF in vchan_complete() and DMA into buffers already unmapped by pci_epf_mhi_edma_read() or nvmet_pci_epf_dma_transfer() oops or panic the endpoint kernel, as the fix commit describes for a late callback after dmaengine_terminate_sync()." } } }