Executive brief
A vulnerability exists in the Linux kernel's data movement engine (dmaengine) that can lead to resource exhaustion. Specifically, the system fails to properly release internal device references when binding or unbinding certain hardware drivers. Over time, this 'leak' can consume system memory and resources, potentially leading to a system crash or instability, affecting the availability of the server or industrial controller.
Technical details
A memory leak (CWE-401) exists in drivers/dma/idxd/compat.c within the Linux kernel. The vulnerability is caused by a failure to call put_device() to drop the reference count incremented by bus_find_device_by_name() during compat bind and unbind sysfs operations. A local attacker with permissions to interact with the sysfs interface can trigger these leaks repeatedly, leading to kernel resource exhaustion and a Denial of Service (DoS). The issue has been resolved by ensuring put_device() is called in both success and error paths within bind_store() and unbind_store().
Affected products
- Linux Linux Kernel 5.15 to 5.15.199, 6.1 to 6.1.162, and other stable branches prior to the fix
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-11-17: disclosed: Initial patch authored by Johan Hovold
- 2026-01-23: patched: Patch committed to stable kernel branches
- 2026-01-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/0c97ff108f825a70c3bb29d65ddf0a013d231bb9
- https://git.kernel.org/stable/c/799900f01792cf8b525a44764f065f83fcafd468
- https://git.kernel.org/stable/c/a7226fd61def74b60dd8e47ec84cabafc39d575b
- https://git.kernel.org/stable/c/b2d077180a56e3b7c97b7517d0465b584adc693b
- https://git.kernel.org/stable/c/b7bd948f89271c92d9ca9b2b682bfba56896e959
- https://git.kernel.org/stable/c/c81ea0222eaaafdd77348e27d1e84a1b8cfc0c99
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html