A bug in the Linux kernel’s Tegra GPC DMA engine causes the controller to hang when a DMA transfer length is not an integer multiple of the configured maximum burst size. The flaw is an improper size handling vulnerability, classified as CWE-131, resulting from an incorrect burst size calculation that fails to adjust the burst size to the largest power‑of‑two divisor that evenly divides the transfer length. This leads to a deadlock that stalls the DMA engine and blocks drivers that rely on it, such as UART transmit paths.

The defect resides in the Tegra GPC DMA engine code path of the Linux kernel. Any kernel build which includes this code path—such as custom or proprietary kernels that target devices with Tegra GPC DMA hardware—may be affected if the kernel has not incorporated the fix.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating low public exploitation activity. The likely attack vector is local; an attacker requires the ability to initiate DMA transfers on the affected hardware, which is usually limited to processes that can configure DMA channels or drivers that directly use DMA. The impact is confined to the DMA controller and any peripheral drivers that depend on it, but it can cascade to system stalls if critical services block.