Executive brief
A vulnerability in the Linux kernel's DMA (Direct Memory Access) management for certain Texas Instruments processors could allow a local user to cause a system resource leak. This occurs when the system fails to properly release internal references during data routing tasks. Over time, this can lead to memory exhaustion or system instability, potentially resulting in a denial-of-service condition.
Technical details
A resource leak (CWE-401) exists in the ti-dma-crossbar driver within the Linux kernel. The function `ti_am335x_xbar_route_allocate` calls `of_find_device_by_node`, which increments the reference count of the platform device, but fails to call `put_device` in several error paths and upon successful completion. A local attacker with the ability to trigger DMA route allocations could exploit this to exhaust kernel memory or prevent device unbinding. The fix introduces a proper cleanup label (`out_put_pdev`) to ensure `put_device` is called before the function returns.
Affected products
- Linux Linux Kernel 4.4.1 to 5.10.249, 5.11 to 5.15.199, 5.16 to 6.1.162, 6.2 to 6.6.122, 6.7 to 6.12.67, 6.13 to 6.18.7
Timeline
- 2025-11-17: patched: Initial patch authored by Johan Hovold
- 2026-01-31: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1befa553f1ecc045dc9ff56107ff50162f63f3c0
- https://git.kernel.org/stable/c/30352277d8e09c972436f883a5efd1f1b763ac14
- https://git.kernel.org/stable/c/43725bd47d984937c429919ae291896d982d1f17
- https://git.kernel.org/stable/c/4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9
- https://git.kernel.org/stable/c/6fdf168f57e331e148a1177a9b590a845c21b315
- https://git.kernel.org/stable/c/c933aa74d9f8d35e6cda322c38c4a907d37a9a2b
- https://git.kernel.org/stable/c/f810132e825588fbad3cba940458c58bb7ec4d84