CVE-2026-46255

dmaengine: fsl-edma: don't explicitly disable clocks in .remove()

Published Jun 3, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fsl-edma: don't explicitly disable clocks in .remove()

The clocks in fsl_edma_engine::muxclk are allocated and enabled with
devm_clk_get_enabled(), which automatically cleans these resources up,
but these clocks are also manually disabled in fsl_edma_remove(). This
causes warnings on driver removal for each clock:

edma_module already disabled
WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1200 clk_core_disable+0x198/0x1c8
[...]
Call trace:
clk_core_disable+0x198/0x1c8 (P)
clk_disable+0x34/0x58
fsl_edma_remove+0x74/0xe8 [fsl_edma]
[...]
---[ end trace 0000000000000000 ]---
edma_module already unprepared
WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1059 clk_core_unprepare+0x1f8/0x220
[...]
Call trace:
clk_core_unprepare+0x1f8/0x220 (P)
clk_unprepare+0x34/0x58
fsl_edma_remove+0x7c/0xe8 [fsl_edma]
[...]
---[ end trace 0000000000000000 ]---

Fix these warnings by removing the unnecessary fsl_disable_clocks() call
in fsl_edma_remove().

Analysis

Technical impact

The Freescale EDMA driver in the Linux kernel disables its clocks twice during module removal. The first call automatically releases the clocks via devm_clk_get_enabled(), and the second call to fsl_disable_clocks() becomes redundant, triggering warning messages during driver removal. This illustrates resource mismanagement corresponding to CWE-832, though no direct security impact such as disclosure or code execution is documented.

Affected Systems

All Linux kernel releases that include the fsl_edma driver for Freescale/NXP QorIQ platforms and are older than the commit that removes the unnecessary fsl_disable_clocks() call (commit 533d495f15e4c88ad5246c7f90ae026702e28d75) are affected. Distributions shipping such kernels should be considered vulnerable until the fix is applied.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is below 1 %. The vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that unloading the fsl_edma module (the typical action that triggers the warnings) requires elevated privileges, so an attacker would need root access to trigger the issue. The overall risk is low and primarily involves benign kernel warnings, with no documented impact on confidentiality, integrity, or availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a9903de3aa16731846bf924342eca44bdabe9be6`	affected	< 533d495f15e4c88ad5246c7f90ae026702e28d75
`a9903de3aa16731846bf924342eca44bdabe9be6`	affected	< 68feac21bd4de7ae4faba05704c404861d991fcf
`a9903de3aa16731846bf924342eca44bdabe9be6`	affected	< bda244871179543dd3be7d093236cb33b2fb1765
`a9903de3aa16731846bf924342eca44bdabe9be6`	affected	< b84dba68c4823da452cec99a5d213571a65d06de
`a9903de3aa16731846bf924342eca44bdabe9be6`	affected	< 666c53e94c1d0bf0bdf14c49505ece9ddbe725bc

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[a9903de3aa16731846bf924342eca44bdabe9be6,533d495f15e4c88ad5246c7f90ae026702e28d75)`	affected	code_commit	—
`[a9903de3aa16731846bf924342eca44bdabe9be6,68feac21bd4de7ae4faba05704c404861d991fcf)`	affected	code_commit	—
`[a9903de3aa16731846bf924342eca44bdabe9be6,bda244871179543dd3be7d093236cb33b2fb1765)`	affected	code_commit	—
`[a9903de3aa16731846bf924342eca44bdabe9be6,b84dba68c4823da452cec99a5d213571a65d06de)`	affected	code_commit	—
`[a9903de3aa16731846bf924342eca44bdabe9be6,666c53e94c1d0bf0bdf14c49505ece9ddbe725bc)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.6`	affected	generic	—
`[0,6.6)`	unaffected	generic	—
`[6.6.128,7.0.0]`	unaffected	generic	—
`[6.12.75,6.13.0]`	unaffected	generic	—
`[6.18.14,6.19.0]`	unaffected	generic	—
`[6.19.4,7.0.0]`	unaffected	generic	—
`[0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the commit removing the redundant fsl_disable_clocks() call in the fsl_edma driver.
Restrict unloading of the fsl_edma module to privileged processes to prevent untrusted users from triggering the warnings.
If a kernel update is not immediately available, patch the module source by removing the fsl_disable_clocks() call in fsl_edma_remove() and monitor system logs for any remaining warnings.

Generated by OpenCVE AI on June 9, 2026 at 23:11 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.114% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/533d495f15e4c88ad5246c7f90ae026702e28d75
https://git.kernel.org/stable/c/666c53e94c1d0bf0bdf14c49505ece9ddbe725bc
https://git.kernel.org/stable/c/68feac21bd4de7ae4faba05704c404861d991fcf
https://git.kernel.org/stable/c/b84dba68c4823da452cec99a5d213571a65d06de
https://git.kernel.org/stable/c/bda244871179543dd3be7d093236cb33b2fb1765
https://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46255-f3b9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46255
https://www.cve.org/CVERecord?id=CVE-2026-46255

History

Jun 9, 2026 8:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Jun 4, 2026 2:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-676

Jun 4, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-832
References		https://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46255-f3b9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46255 https://www.cve.org/CVERecord?id=CVE-2026-46255
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Jun 3, 2026 8:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-676

Jun 3, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: don't explicitly disable clocks in .remove() The clocks in fsl_edma_engine::muxclk are allocated and enabled with devm_clk_get_enabled(), which automatically cleans these resources up, but these clocks are also manually disabled in fsl_edma_remove(). This causes warnings on driver removal for each clock: edma_module already disabled WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1200 clk_core_disable+0x198/0x1c8 [...] Call trace: clk_core_disable+0x198/0x1c8 (P) clk_disable+0x34/0x58 fsl_edma_remove+0x74/0xe8 [fsl_edma] [...] ---[ end trace 0000000000000000 ]--- edma_module already unprepared WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1059 clk_core_unprepare+0x1f8/0x220 [...] Call trace: clk_core_unprepare+0x1f8/0x220 (P) clk_unprepare+0x34/0x58 fsl_edma_remove+0x7c/0xe8 [fsl_edma] [...] ---[ end trace 0000000000000000 ]--- Fix these warnings by removing the unnecessary fsl_disable_clocks() call in fsl_edma_remove().
Title		dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/533d495f15e4c88ad5246c7f90ae026702e28d75 https://git.kernel.org/stable/c/666c53e94c1d0bf0bdf14c49505ece9ddbe725bc https://git.kernel.org/stable/c/68feac21bd4de7ae4faba05704c404861d991fcf https://git.kernel.org/stable/c/b84dba68c4823da452cec99a5d213571a65d06de https://git.kernel.org/stable/c/bda244871179543dd3be7d093236cb33b2fb1765