CVE-2026-72474

Received Received - Intake

Linux Kernel DMA Descriptor Use-After-Free Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 (where this IP is used), DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might remap (and hence vmalloc()) some memory. This became visible in a design where dma_direct_use_pool() is not possible. With the above, when calling dma_free_coherent(), vunmap() would be called from softirq context and thus leading to a BUG(). To fix it, use a dma pool that is allocated in .device_alloc_chan_resources() and allocate blocks from it. The key point is that now dma_pool_free() is used in axi_dmac_free_desc() to free the blocks and that just frees the blocks from the pool in the sense they can be used again. In other words, no actual call to dma_free_coherent() happens. That only happens when destroying the pool in axi_dmac_free_chan_resources() which does not happen in any interrupt context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72474

EUVD

EUVD-2026-59373

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
linux_kernel	dmaengine	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bug in the dma-axi-dmac driver where improper handling of DMA descriptors could lead to a system crash. Specifically, when DMA_DIRECT_REMAP is enabled, calling dma_free_coherent() from softirq context triggers a BUG() due to vunmap() being called in an interrupt context. The fix involves using a DMA pool to manage descriptors, avoiding direct calls to dma_free_coherent() in interrupt contexts.

Detection Guidance

This vulnerability is specific to the Linux kernel's dmaengine subsystem, particularly in the dma-axi-dmac driver. Detection requires checking kernel logs for BUG() messages related to vunmap() in softirq context. Monitor dmesg for errors like 'BUG: scheduling while atomic' or 'vunmap() called from softirq context'.

Impact Analysis

This vulnerability could cause system instability or crashes, particularly on systems using Microblaze or arm64 architectures with the affected DMA driver. It may lead to kernel panics or unexpected reboots when DMA operations are performed, potentially disrupting services or causing data loss.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel DMA engine issue that could cause system instability by triggering a BUG() in softirq context due to improper memory handling. Compliance impacts would only occur if the vulnerability led to data corruption, unauthorized access, or system failures affecting protected data processing.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-72474. This vulnerability is resolved by changes in the dmaengine subsystem, specifically in the dma-axi-dmac driver.

Hi! I’m here to help you understand CVE-2026-72474. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70