{"id":"CVE-2026-93042","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-93042","summary":"dmaengine: dw-edma: Terminate all descriptors without callbacks","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: Terminate all descriptors without callbacks\n\nThe DMA Engine client documentation says in the \"Terminate APIs\" section\nof Documentation/driver-api/dmaengine/client.rst:\n\n\"No callback functions will be called for any incomplete transfers.\"\n\ndw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches\nthe interrupt handler. This schedules a callback for the active descriptor\nand leaves other issued or submitted descriptors queued. A late callback\nafter dmaengine_terminate_sync() can dereference client state that has\nalready been freed, while leftover descriptors may later restart into\nreused buffers or leak.\n\nMove all issued and submitted descriptors to the terminated list whenever\ntermination completes. For a pending STOP, do this from both the DONE and\nABORT paths. Complete their cookies in order without scheduling callbacks.\n\nA STOP can remain pending until the running transfer raises an\ninterrupt. Make device_synchronize() wait for such a pending STOP to\ncomplete before releasing terminated descriptors. Reuse it from\nfree_chan_resources(), then release the remaining virt-dma resources.\nSleep instead of busy-polling while waiting, and warn if the existing\ntimeout expires.","published":"2026-09-17T16:10:34.911Z","modified":"2026-09-18T03:48:43.749078546Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.157"}],"fix":null,"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4793f9099a1cadf4e37f3a03d524af6bce88a0ea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/65e387b95d3855aa894ac729e1778e5bcb9083cb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/99109a51efd28c9a661fbfb9469b023c517b31d1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/be87d86537de7ea6fd025f41033d2faff880973f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93042.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93042"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T03:48:43.749078546Z"}}