CVE-2026-98324
Received Received - Intake

Double Counting in Linux Kernel DMA Engine

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was converted from kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT) to kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc itself - but only where the compiler has __builtin_counted_by_ref(), so from gcc 15.1 or clang 22.1 on. The loop below it still increments nb_desc, which makes it come out doubled there and correct elsewhere. nb_desc is what pxad_free_desc() iterates over and what set_updater_desc() indexes from, so set it explicitly and drop the increment. The error path has to lower it to the number of descriptors allocated so far, otherwise pxad_free_desc() would free entries that were never allocated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98324
EUVD
EUVD-2026-93309

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 69050f8d6d075dc01af7a5f2f550a8067510366f
Linux Linux 69050f8d6d075dc01af7a5f2f550a8067510366f
Linux Linux 7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect counting of DMA descriptors in the pxa dmaengine driver. When converting pxad_alloc_desc() to use kzalloc_flex(), the code still manually increments a descriptor counter (nb_desc) even though kzalloc_flex() already sets it. This causes the counter to double in some cases, leading to potential memory corruption or use-after-free issues when descriptors are freed or accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's dmaengine subsystem, particularly in the PXA DMA driver. Detection requires checking the kernel version and examining the affected driver code. Use uname -a to check your kernel version and grep for pxa dmaengine in your kernel logs or source code.

Impact Analysis

This vulnerability could lead to system instability, crashes, or security issues if exploited. Systems using affected Linux kernel versions with the pxa dmaengine driver may experience memory corruption, data corruption, or denial-of-service conditions due to incorrect descriptor handling.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this issue. If a patch is not yet available, consider disabling the PXA DMA driver if not in use. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart