Description
In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

Once the interrupt is requested, the interrupt handler may run immediately.
Since the IRQ handler can access channel->ch_base, which is initialized
only after requesting the IRQ, this may lead to invalid memory access.
Likewise, the IRQ thread may access uninitialized data (the ld_free,
ld_queue, and ld_active lists), which may also lead to issues.

Request the interrupts only after everything is set up. To keep the error
path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().
Published: 2026-08-15
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper ordering of interrupt request setup in the Linux kernel’s RZ‑DMAC driver causes the interrupt handler to run before channel->ch_base and other critical data structures are fully initialized. If the handler attempts to access these incomplete structures, it can trigger invalid memory accesses leading to kernel crashes or other instability. The flaw manifests as a race condition that results in an out‑of‑band memory corruption scenario, potentially allowing unreliable system operation.

Affected Systems

The flaw affects all Linux kernel builds that include the RZ‑DMAC driver prior to the patch referenced in the advisory. All architectures that implement the driver – represented by Linux:Linux in the vendor list – are potentially impacted, with no specific version constraints supplied.

Risk and Exploitability

The CVSS score is 8.4, indicating a high severity. EPSS score is < 1%, indicating a very low exploitation probability. Attackers would need local or higher privileges to trigger the driver’s interrupt handling, so the attack vector is inferred to be local execution rather than remote. The vulnerability involves direct memory corruption in kernel space, which can lead to kernel crashes or other instability. The entry is not listed in the CISA KEV catalog, indicating that no known widespread exploits have been observed yet.

Generated by OpenCVE AI on August 22, 2026 at 11:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that incorporates the RZ‑DMAC driver patch that moves the interrupt request after the channel structures are fully initialized and uses dmam_alloc_coherent() for DMA allocation.
  • If an immediate kernel upgrade is not possible, disable or unload the affected RZ‑DMAC module to prevent the driver from operating until the patch can be applied.
  • If the patch cannot be applied promptly, modify the driver source to request the interrupt only after all channel data structures are set up and replace dma_alloc_coherent() with dmam_alloc_coherent() to mitigate the initialization issue.

Generated by OpenCVE AI on August 22, 2026 at 11:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4745-1 linux-6.12 security update
History

Sat, 22 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Wed, 19 Aug 2026 16:45:00 +0000


Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-824
References
Metrics threat_severity

None

threat_severity

Moderate


Mon, 17 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}


Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also lead to issues. Request the interrupts only after everything is set up. To keep the error path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().
Title dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-19T16:36:26.048Z

Reserved: 2026-08-09T03:40:39.908Z

Link: CVE-2026-72146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:32.267

Modified: 2026-08-19T17:21:00.233

Link: CVE-2026-72146

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72146 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T11:45:03Z

Weaknesses
  • CWE-824

    Access of Uninitialized Pointer