Description
In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

When terminating DMA transfers, active descriptors are not properly
reclaimed. Only cyclic descriptors were handled, leaving non-cyclic
descriptors and their LLI chains to be permanently leaked.

Fix by using vchan_terminate_vdesc() which handles both cyclic and
non-cyclic descriptors by adding them to desc_terminated queue for
proper cleanup.

Add pchan->desc != pchan->done check to prevent double-adding completed
descriptors, which would corrupt the list.
Published: 2026-09-04
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Active DMA descriptors are not reclaimed after transfer termination, causing non‑cyclic descriptors and their linked‑list chains to accumulate permanently. This defect results in a kernel memory leak that can drain available memory over time and potentially disrupt system availability. The vulnerability is a resource exhaustion flaw and is classified under CWE‑401.

Affected Systems

All Linux kernel builds that include the sun6i DMA driver are affected. The kernel vendor is Linux, product Linux kernel, and affected releases are those that ship with a sun6i platform and have not applied the commit that fixes vchan descriptor reclamation. No specific version range is listed.

Risk and Exploitability

No CVSS or EPSS score is available, and the vulnerability is not listed in CISA KEV. The attack surface is limited to local privilege; an attacker would need to execute code on the host that initiates DMA transfers or causes a driver reload to trigger the leak. Based on the description, it is inferred that the vulnerability could be exploited through local code execution that repeatedly starts and stops DMA, leading to kernel memory exhaustion and a denial of service.

Generated by OpenCVE AI on September 4, 2026 at 20:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a release that includes the vchan_terminate_vdesc patch for the sun6i DMA driver
  • If an official kernel update is not yet available, manually apply the patch from the referenced kernel commits and rebuild the kernel
  • After patching, monitor kernel memory usage to verify that DMA descriptor cleanup behaves correctly and that no additional leaks occur

Generated by OpenCVE AI on September 4, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leaving non-cyclic descriptors and their LLI chains to be permanently leaked. Fix by using vchan_terminate_vdesc() which handles both cyclic and non-cyclic descriptors by adding them to desc_terminated queue for proper cleanup. Add pchan->desc != pchan->done check to prevent double-adding completed descriptors, which would corrupt the list.
Title dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-04T17:11:17.510Z

Reserved: 2026-08-26T14:34:25.800Z

Link: CVE-2026-80902

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:17:59.260

Modified: 2026-09-04T18:17:59.260

Link: CVE-2026-80902

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T20:30:16Z

Weaknesses

No weakness.