« Back to list

CVE-2026-72149

Status: ReceivedHigh (7.5)—

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: tegra: Fix burst size calculation

Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length is not evenly divisible by the configured max burst size, the DMA hangs with partial burst at the end.

Fix this by reducing the burst size to the largest power-of-2 value that evenly divides the transfer length. For example, a 40-byte transfer with a 16-byte max burst will now use an 8-byte burst (40 / 8 = 5 complete bursts) instead of causing a hang.

Read full descriptionShow less

This issue was observed with the PL011 UART driver where TX DMA transfers of arbitrary lengths were stuck.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector CVSS AV:N sugiere T1190, pero es DoS de kernel sin interacción remota real. El hang del DMA causa negación de servicio de aplicaciones (TX UART bloqueada), alineado con T1499.004 (exhaustión de aplicación).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux KernelAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-72149",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "735951baa311c66353405dcac39375dd66441db0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "8f0f5de1091119679d87f60dfb1acbff4b2a0ed3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "a3b76b54e06d73166af4d1a284a0e0711889060c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "7926c1e4be86379945fb5f168888ac4d2aaf6c91",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee17028009d49fffed8cc963455d33b1fd3f1d08",
              "lessThan": "4651df83b6c796daead3447e8fd874322918ee4f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/dma/tegra186-gpc-dma.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/dma/tegra186-gpc-dma.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:32.610",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4651df83b6c796daead3447e8fd874322918ee4f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/735951baa311c66353405dcac39375dd66441db0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7926c1e4be86379945fb5f168888ac4d2aaf6c91",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f0f5de1091119679d87f60dfb1acbff4b2a0ed3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3b76b54e06d73166af4d1a284a0e0711889060c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: tegra: Fix burst size calculation\n\nCurrently, the Tegra GPC DMA hardware requires the transfer length to\nbe a multiple of the max burst size configured for the channel. When a\nclient requests a transfer where the length is not evenly divisible by\nthe configured max burst size, the DMA hangs with partial burst at\nthe end.\n\nFix this by reducing the burst size to the largest power-of-2 value\nthat evenly divides the transfer length. For example, a 40-byte\ntransfer with a 16-byte max burst will now use an 8-byte burst\n(40 / 8 = 5 complete bursts) instead of causing a hang.\n\nThis issue was observed with the PL011 UART driver where TX DMA\ntransfers of arbitrary lengths were stuck."
    }
  ],
  "lastModified": "2026-08-17T06:18:15.033",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}