CVE-2026-93170 - Vulnerability Details

- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

Fix a race condition in AXIDMA and MCDMA irq handlers where the channel
could be incorrectly marked as idle and attempt spurious transfers when
descriptors are still being processed.

The issue occurs when:
1. Multiple descriptors are queued and active.
2. An interrupt fires after completing some descriptors.
3. xilinx_dma_complete_descriptor() moves completed descriptors to
done_list.
4. Channel is marked idle and start_transfer() is called even though
active_list still contains unprocessed descriptors.
5. This leads to premature transfer attempts and potential descriptor
corruption or missed completions.

Only mark the channel as idle and start new transfers when the active list
is actually empty, ensuring proper channel state management and avoiding
spurious transfer attempts.

Published: 2026-09-17

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition exists within the Xilinx AXIDMA and MCDMA interrupt handlers of the Linux kernel. The channel could be incorrectly marked idle while descriptors are still active, causing the driver to initiate new transfers prematurely. This leads to descriptor corruption or missed completions, jeopardizing the integrity of data being moved through the DMA engine. The vulnerability’s weakness is a concurrent execution race condition that allows unsafe state changes during interrupt handling.

Affected Systems

All Linux kernel versions that contain the Xilinx DMA driver without the patch referenced in the CVE, including the branches that use the AXIDMA and MCDMA engines. The exact affected releases are not enumerated, but any kernel that incorporates the vulnerable driver before the fix would be impacted.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity of potential impact, yet the EPSS score of less than 1% implies a low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and the typical attack vector would be local privileged access that can queue or manipulate DMA descriptors. Although the exploitability is limited by the need for kernel-space interaction, successful exploitation would result in data corruption or loss of service, making it a significant risk for systems relying on DMA operations.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< 7f4b989d7d87381927b98d64492f8dcf979f57ab
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< 5459e02707b27a964ae72e028d3ff72a3b687c4a
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< 425630e9eea1f9f8912b8c6abf01e0dab1e27917
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< fdaf297ab275c6efecac5e87669c31bc89b74297
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< c27d16fd2358b2fc3e1ffaca03afd11dc28630ea
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< ec927657524be4438447944a58173c7baf7f2384
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< c3e943490ced0b9ad475844eda7661f6a9bcfb4a
`c0bba3a99f0709c24c2c7ada7cb098966b1d791f`	affected	< 0b6d055edb55ecadadf54e930c2b4fab76fa9a5a

Linux

affected

Version	Status	Constraints
`4.7`	affected	—
`0`	unaffected	< 4.7
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,7f4b989d7d87381927b98d64492f8dcf979f57ab)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,5459e02707b27a964ae72e028d3ff72a3b687c4a)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,425630e9eea1f9f8912b8c6abf01e0dab1e27917)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,fdaf297ab275c6efecac5e87669c31bc89b74297)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,c27d16fd2358b2fc3e1ffaca03afd11dc28630ea)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,ec927657524be4438447944a58173c7baf7f2384)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,c3e943490ced0b9ad475844eda7661f6a9bcfb4a)`	affected	code_commit	—
`[c0bba3a99f0709c24c2c7ada7cb098966b1d791f,0b6d055edb55ecadadf54e930c2b4fab76fa9a5a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.7`	affected	generic	—
`[0,4.7)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that resolves the race condition, such as the commit 0b6d055edb55ecadadf54e930c2b4fab76fa9a5a or any later merge that includes the fix.
Upgrade the system to a kernel version that contains the patched Xilinx DMA driver, ensuring the latest stable release is running.
If a patch or newer kernel cannot be applied immediately, consider disabling or blacklisting the Xilinx DMA driver to prevent spurious channel state changes until a fix is available.
Verify that all DMA queues are properly drained and that no active descriptors remain when the kernel is shutting down or updating the driver to mitigate side effects.

Generated by OpenCVE AI on September 19, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b6d055edb55ecadadf54e930c2b4fab76fa9a5a
https://git.kernel.org/stable/c/425630e9eea1f9f8912b8c6abf01e0dab1e27917
https://git.kernel.org/stable/c/5459e02707b27a964ae72e028d3ff72a3b687c4a
https://git.kernel.org/stable/c/7f4b989d7d87381927b98d64492f8dcf979f57ab
https://git.kernel.org/stable/c/c27d16fd2358b2fc3e1ffaca03afd11dc28630ea
https://git.kernel.org/stable/c/c3e943490ced0b9ad475844eda7661f6a9bcfb4a
https://git.kernel.org/stable/c/ec927657524be4438447944a58173c7baf7f2384
https://git.kernel.org/stable/c/fdaf297ab275c6efecac5e87669c31bc89b74297

History

Sat, 19 Sep 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious transfers when descriptors are still being processed. The issue occurs when: 1. Multiple descriptors are queued and active. 2. An interrupt fires after completing some descriptors. 3. xilinx_dma_complete_descriptor() moves completed descriptors to done_list. 4. Channel is marked idle and start_transfer() is called even though active_list still contains unprocessed descriptors. 5. This leads to premature transfer attempts and potential descriptor corruption or missed completions. Only mark the channel as idle and start new transfers when the active list is actually empty, ensuring proper channel state management and avoiding spurious transfer attempts.
Title		dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b6d055edb55ecadadf54e930c2b4fab76fa9a5a https://git.kernel.org/stable/c/425630e9eea1f9f8912b8c6abf01e0dab1e27917 https://git.kernel.org/stable/c/5459e02707b27a964ae72e028d3ff72a3b687c4a https://git.kernel.org/stable/c/7f4b989d7d87381927b98d64492f8dcf979f57ab https://git.kernel.org/stable/c/c27d16fd2358b2fc3e1ffaca03afd11dc28630ea https://git.kernel.org/stable/c/c3e943490ced0b9ad475844eda7661f6a9bcfb4a https://git.kernel.org/stable/c/ec927657524be4438447944a58173c7baf7f2384 https://git.kernel.org/stable/c/fdaf297ab275c6efecac5e87669c31bc89b74297

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:12:01.249Z

Updated: 2026-09-18T17:56:19.469Z

Reserved: 2026-09-17T16:02:15.090Z

Link: CVE-2026-93170

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:18:12.700

Modified: 2026-09-18T18:18:23.360

Link: CVE-2026-93170

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T05:00:11Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object