« Volver al listado

CVE-2026-93170

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious transfers when descriptors are still being processed.

The issue occurs when: 1. Multiple descriptors are queued and active. 2. An interrupt fires after completing some descriptors. 3. xilinx_dma_complete_descriptor() moves completed descriptors to done_list. 4. Channel is marked idle and start_transfer() is called even though active_list still contains unprocessed descriptors. 5. This leads to premature transfer attempts and potential descriptor corruption or missed completions.

Leer descripción completaMostrar menos

Only mark the channel as idle and start new transfers when the active list is actually empty, ensuring proper channel state management and avoiding spurious transfer attempts.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L sin UI indica escalada local post-acceso; la corrupción de descriptores y fallos de transferencia causan DoS y manipulación de datos en memoria del kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93170",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "7f4b989d7d87381927b98d64492f8dcf979f57ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "5459e02707b27a964ae72e028d3ff72a3b687c4a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "425630e9eea1f9f8912b8c6abf01e0dab1e27917",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "fdaf297ab275c6efecac5e87669c31bc89b74297",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "c27d16fd2358b2fc3e1ffaca03afd11dc28630ea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "ec927657524be4438447944a58173c7baf7f2384",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "c3e943490ced0b9ad475844eda7661f6a9bcfb4a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0bba3a99f0709c24c2c7ada7cb098966b1d791f",
              "lessThan": "0b6d055edb55ecadadf54e930c2b4fab76fa9a5a",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/dma/xilinx/xilinx_dma.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/dma/xilinx/xilinx_dma.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:18:12.700",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0b6d055edb55ecadadf54e930c2b4fab76fa9a5a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/425630e9eea1f9f8912b8c6abf01e0dab1e27917",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5459e02707b27a964ae72e028d3ff72a3b687c4a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7f4b989d7d87381927b98d64492f8dcf979f57ab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c27d16fd2358b2fc3e1ffaca03afd11dc28630ea",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3e943490ced0b9ad475844eda7661f6a9bcfb4a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ec927657524be4438447944a58173c7baf7f2384",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fdaf297ab275c6efecac5e87669c31bc89b74297",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers\n\nFix a race condition in AXIDMA and MCDMA irq handlers where the channel\ncould be incorrectly marked as idle and attempt spurious transfers when\ndescriptors are still being processed.\n\nThe issue occurs when:\n1. Multiple descriptors are queued and active.\n2. An interrupt fires after completing some descriptors.\n3. xilinx_dma_complete_descriptor() moves completed descriptors to\ndone_list.\n4. Channel is marked idle and start_transfer() is called even though\n   active_list still contains unprocessed descriptors.\n5. This leads to premature transfer attempts and potential descriptor\n   corruption or missed completions.\n\nOnly mark the channel as idle and start new transfers when the active list\nis actually empty, ensuring proper channel state management and avoiding\nspurious transfer attempts."
    }
  ],
  "lastModified": "2026-09-18T18:18:23.360",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}