Executive brief
The Linux kernel's Synopsys eDMA IP core driver (dw-edma) contains a NULL pointer dereference vulnerability in its interrupt request initialization code. The driver registers interrupt handlers before fully initializing the data structures they depend on, allowing a shared interrupt to trigger the handler before critical pointers are set. This can crash the kernel or cause system instability on systems using this DMA controller.
Technical details
The vulnerability is a race condition in dw_edma_irq_request() where struct dw_edma_irq is passed to request_irq() before the back pointer (dw_irq->dw) is initialized by dw_edma_channel_setup(). If a shared interrupt fires between request_irq() and the pointer initialization, the interrupt handler dereferences NULL, causing a kernel panic. The fix moves pointer initialization before request_irq() calls in both the common IRQ path and per-channel IRQ paths. This is a kernel-level issue affecting any system with Synopsys eDMA hardware; no user interaction or elevated privileges are required to trigger.
Affected products
- Linux Linux kernel multiple versions affected (e63d79d1ffcd onwards prior to 2026-09-14 stable releases)
Timeline
- 2026-09-16: disclosed: CVE-2026-89993 published
- 2026-09-14: patched: Fix merged to stable kernel trees