Executive brief
The Linux kernel's dw-edma-pcie driver (used for DMA operations on PCIe devices) fails to validate driver data before use, allowing a NULL pointer dereference that crashes the system. An attacker with local system access could trigger this by dynamically binding a device via sysfs, causing a denial of service.
Technical details
The vulnerability is a NULL pointer dereference in the dw_edma_pcie_probe() function. The driver unconditionally copies PCI device ID driver_data as a controller layout template without checking if it exists. A device bound dynamically via sysfs can match the driver without driver_data populated, resulting in a crash. The fix adds a simple NULL check that returns -ENODEV before the device is enabled if pdata is NULL. Attack requires local access to bind devices via sysfs.
Affected products
- Linux Linux kernel Multiple versions (fix available in stable branches)
Timeline
- 2026-08-15: disclosed: CVE-2026-72147 published
- 2026-07-24: patched: Fix merged in stable kernel branches
- 2026-05-21: other: Patch submitted by Koichiro Den