Executive brief
A race condition vulnerability was identified in the Linux kernel's DMA (Direct Memory Access) engine driver for MMP PDMA. This component manages high-speed data transfers between memory and peripherals. An exploit could allow a local attacker to cause a system crash or potentially execute unauthorized code by triggering a memory error during simultaneous data operations.
Technical details
A race condition exists in the mmp_pdma_residue() function of the Linux kernel's dmaengine subsystem. The vulnerability is caused by a lack of proper locking when accessing the descriptor list and its contents. When multiple threads call tx_status() while a tasklet on another CPU is freeing completed descriptors, a use-after-free (UAF) condition occurs. An attacker with local access can exploit this race to cause a kernel panic or potentially achieve privilege escalation. The issue has been resolved by implementing spinlock protection (chan->desc_lock) around the chain_running list iteration and descriptor access.
Affected products
- Linux Linux Kernel 3.16 to 6.18.10, 6.19-rc1 to 6.19-rc5
Timeline
- 2025-12-16: patched: Initial patch submitted to the dmaengine subsystem
- 2026-02-14: advisory: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/3f0e0e2d9e752570041e95fd04635e2580097819
- https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c
- https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7
- https://git.kernel.org/stable/c/dfb5e05227745de43b7fd589721817a4337c970d
- https://git.kernel.org/stable/c/eba0c75670c022cb1f948600db972524bcfe8166
- https://git.kernel.org/stable/c/fc023b8fab057f0c910856ff36d3e12a30b7af4a