« Volver al listado

CVE-2026-72149

Estado: RecibidaAlta (7.5)—

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: tegra: Fix burst size calculation

Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length is not evenly divisible by the configured max burst size, the DMA hangs with partial burst at the end.

Fix this by reducing the burst size to the largest power-of-2 value that evenly divides the transfer length. For example, a 40-byte transfer with a 16-byte max burst will now use an 8-byte burst (40 / 8 = 5 complete bursts) instead of causing a hang.

Leer descripción completaMostrar menos

This issue was observed with the PL011 UART driver where TX DMA transfers of arbitrary lengths were stuck.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N sugiere T1190, pero es DoS de kernel sin interacción remota real. El hang del DMA causa negación de servicio de aplicaciones (TX UART bloqueada), alineado con T1499.004 (exhaustión de aplicación).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72149",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "735951baa311c66353405dcac39375dd66441db0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "8f0f5de1091119679d87f60dfb1acbff4b2a0ed3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "a3b76b54e06d73166af4d1a284a0e0711889060c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "7926c1e4be86379945fb5f168888ac4d2aaf6c91",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "4651df83b6c796daead3447e8fd874322918ee4f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/dma/tegra186-gpc-dma.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/dma/tegra186-gpc-dma.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:32.610",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4651df83b6c796daead3447e8fd874322918ee4f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/735951baa311c66353405dcac39375dd66441db0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7926c1e4be86379945fb5f168888ac4d2aaf6c91",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f0f5de1091119679d87f60dfb1acbff4b2a0ed3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3b76b54e06d73166af4d1a284a0e0711889060c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: tegra: Fix burst size calculation\n\nCurrently, the Tegra GPC DMA hardware requires the transfer length to\nbe a multiple of the max burst size configured for the channel. When a\nclient requests a transfer where the length is not evenly divisible by\nthe configured max burst size, the DMA hangs with partial burst at\nthe end.\n\nFix this by reducing the burst size to the largest power-of-2 value\nthat evenly divides the transfer length. For example, a 40-byte\ntransfer with a 16-byte max burst will now use an 8-byte burst\n(40 / 8 = 5 complete bursts) instead of causing a hang.\n\nThis issue was observed with the PL011 UART driver where TX DMA\ntransfers of arbitrary lengths were stuck."
    }
  ],
  "lastModified": "2026-08-17T06:18:15.033",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}