Executive brief
The Linux kernel's Synopsys eDMA IP driver contains a race condition in the DMA channel initialization code. When multiple DMA channels start simultaneously, they can corrupt each other's configuration by performing concurrent, non-atomic modifications to shared interrupt mask registers. This can lead to DMA transfers failing silently or interrupts being missed, causing data loss or system hangs in devices relying on DMA operations.
Technical details
The vulnerability is a race condition in the dw-edma driver's dw_edma_v0_core_start() function. The DONE_INT_MASK and ABORT_INT_MASK registers are shared across all DMA channels, but modifications require a read-modify-write sequence that is not atomic. Concurrent calls from multiple channels can interleave these operations, causing register corruption. The fix adds a raw spinlock around the critical section that accesses these shared registers, serializing access and preventing the race condition. This affects the Synopsys eDMA IP version 0 implementation in the dmaengine subsystem. The vulnerability requires the system to have multiple active DMA channels, but no special privileges or network access are needed for exploitation.
Affected products
- Linux Linux kernel Versions with dmaengine dw-edma driver (since introduction in commit 7e4b8a4fbe2c, across 4.x and later stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix committed upstream and backported to stable branches