Executive brief
The Linux kernel's xilinx_dma (Direct Memory Access) driver contains a flaw in its timeout mechanism that can cause the CPU to busy-wait for several minutes instead of timing out promptly when hardware does not respond. This can cause system performance degradation and is triggered when DMA transfers fail to complete as expected due to hardware issues.
Technical details
The vulnerability exists in the xilinx_dma_poll_timeout function when called with delay_us=0 and an unfulfilled condition. The underlying poll_timeout_us_atomic function underestimates wall clock time (a regression from commit 7349a69cf312), causing the timeout calculation to be off by a factor of 1000× or more. Instead of timing out after approximately 1 second (XILINX_DMA_LOOP_COUNT microseconds), the CPU busy-waits for several minutes, effectively causing a denial of service on that CPU core. The fix changes delay_us from 0 to 10 microseconds, which restores proper timeout behavior. This is a local attack vector requiring the ability to trigger DMA operations on systems with the vulnerable xilinx_dma driver.
Affected products
- Linux Linux kernel affected versions prior to fix commit
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched