Junglewise Threat Intelligence

CVE-2026-93170: Linux kernel xilinx_dma race condition in idle state management

CVE-2026-93170 · Severity: high · CVSS 7.8 · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's Xilinx DMA driver contains a race condition in its interrupt handlers that can cause direct memory access (DMA) channels to be incorrectly marked idle and attempt transfers while descriptors are still being processed. This can lead to corrupted data transfers, missed completions, or system instability on systems using Xilinx DMA controllers for I/O acceleration.

Technical details

The vulnerability is a race condition in the AXIDMA and MCDMA interrupt handlers (xilinx_dma_irq_handler and xilinx_mcdma_irq_handler) in drivers/dma/xilinx/xilinx_dma.c. When an interrupt fires after completing some descriptors, the handler calls xilinx_dma_complete_descriptor() to move completed descriptors to the done list, then immediately marks the channel as idle and calls start_transfer(). However, if unprocessed descriptors remain in the active_list, this triggers spurious transfer attempts, leading to descriptor corruption or missed completions. The fix adds a check to verify the active_list is empty before marking the channel idle and starting new transfers. No authentication or elevated privileges are required to trigger this race condition on affected systems.

Affected products

  • Linux Linux Kernel Multiple versions (see kernel.org stable branches)

Timeline

  • 2026-09-17: disclosed
  • 2026-06-26: patched: Fix committed upstream
  • 2026-07-02: other: Patch merged by Vinod Koul

References

Related threats