CVE-2026-72147
Received Received - Intake

DMA Engine NULL Pointer Dereference in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dw_edma_pcie_probe() treats the PCI device ID driver_data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can match the driver without that data, which leads to a NULL pointer dereference. Reject such matches before enabling the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72147
EUVD
EUVD-2026-58905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the dw-edma-pcie driver. When a PCI device is dynamically bound via sysfs without proper driver data, the driver incorrectly uses the device ID as a template and copies it unconditionally. This leads to a NULL pointer dereference when the device is enabled, causing a potential system crash or instability.

Detection Guidance

This vulnerability can be detected by checking if the Linux kernel version is affected. Use uname -r to check the kernel version. If it is a vulnerable version, look for crashes or NULL pointer dereference errors in system logs related to dmaengine or dw-edma-pcie.

Impact Analysis

If exploited, this vulnerability could cause system crashes or instability by triggering a NULL pointer dereference. Systems using the affected Linux kernel component may experience unexpected failures, data corruption, or denial of service if an attacker can bind a malicious device dynamically.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor kernel logs for NULL pointer dereference errors in dmaengine or dw-edma-pcie. Avoid binding PCI devices dynamically via sysfs if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart