Executive brief
The Linux kernel's Xilinx DMA driver contains a race condition in its interrupt handlers that can cause direct memory access (DMA) channels to be incorrectly marked idle and attempt transfers while descriptors are still being processed. This can lead to corrupted data transfers, missed completions, or system instability on systems using Xilinx DMA controllers for I/O acceleration.
Technical details
The vulnerability is a race condition in the AXIDMA and MCDMA interrupt handlers (xilinx_dma_irq_handler and xilinx_mcdma_irq_handler) in drivers/dma/xilinx/xilinx_dma.c. When an interrupt fires after completing some descriptors, the handler calls xilinx_dma_complete_descriptor() to move completed descriptors to the done list, then immediately marks the channel as idle and calls start_transfer(). However, if unprocessed descriptors remain in the active_list, this triggers spurious transfer attempts, leading to descriptor corruption or missed completions. The fix adds a check to verify the active_list is empty before marking the channel idle and starting new transfers. No authentication or elevated privileges are required to trigger this race condition on affected systems.
Affected products
- Linux Linux Kernel Multiple versions (see kernel.org stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-06-26: patched: Fix committed upstream
- 2026-07-02: other: Patch merged by Vinod Koul