Executive brief
The Linux kernel's Synopsys eDMA (Direct Memory Access Engine) driver contains a race condition in its interrupt abort handler. When the abort interrupt releases its lock prematurely, another function can observe stale state information and skip queuing new data transfers, causing them to hang indefinitely. This affects systems relying on DMA operations for device I/O, potentially degrading performance or causing I/O timeouts.
Technical details
The vulnerability is a race condition (CWE-362) in the dw_edma_abort_interrupt() function within drivers/dma/dw-edma/dw-edma-core.c. The abort handler releases the vc.lock spinlock before updating the request and status fields, creating a window where issue_pending() can acquire the lock, observe the old (busy) channel state, and incorrectly skip starting queued descriptors. The abort handler then overwrites the channel status to idle, leaving newly queued descriptors stranded. The fix serializes descriptor completion and state transition within the same critical section by moving the spin_unlock_irqrestore() call after the status and request field updates. No authentication or network access required; this is a local kernel synchronization bug affecting any system using the dw-edma driver.
Affected products
- Linux Linux kernel affected versions uncertain; fix present in multiple stable branches (5.10 through 6.x and master)
Timeline
- 2026-09-17: disclosed: CVE-2026-93041 published
- 2026-07-18: patched: Upstream fix committed (dd80e259f65d932634e26d366570d71669ef6654)
- 2026-09-14: patched: Backported to stable branches