Executive brief
The Linux kernel's fsl-edma DMA engine driver contains a use-after-free vulnerability in its tracing functionality. When tracing events are logged, the driver dereferences a pointer to a kernel data structure that may have already been freed, potentially causing a kernel crash. An attacker with access to the kernel tracing interface can trigger this crash, leading to a denial of service.
Technical details
The vulnerability is a use-after-free in the fsl-edma kernel driver's trace event handler. The trace events store a pointer to a struct fsl_edma_engine in the ring buffer and dereference it when printing log entries. However, at the time the log entry is printed, the pointed-to structure may have already been freed. An unprivileged attacker can trigger this via the kernel tracing interface by injecting a malicious trace event. The fix adds a new membase field to the trace event structure to capture the required memory base address at event creation time, eliminating the need to dereference the potentially stale engine pointer during log output. A patch is available in the Linux kernel stable trees.
Affected products
- Linux Linux kernel multiple versions prior to fix (2026-07-18)
Timeline
- 2026-07-18: other: Fix committed by Martin Kaiser
- 2026-09-16: disclosed: Published as CVE-2026-89994