{"id":"CVE-2026-93042","aliases":[],"cve":{"records":[{"id":"CVE-2026-93042","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T15:57:05.657Z","published":"2026-09-17T16:10:34.911Z","modified":"2026-10-30T12:35:46.423Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:35:46.423Z"}],"references":[{"url":"https://git.kernel.org/stable/c/da56839aced48ecb70033962d7ea98f55b0c5656","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/65e387b95d3855aa894ac729e1778e5bcb9083cb","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/4793f9099a1cadf4e37f3a03d524af6bce88a0ea","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/be87d86537de7ea6fd025f41033d2faff880973f","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/99109a51efd28c9a661fbfb9469b023c517b31d1","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"dmaengine: dw-edma: Terminate all descriptors without callbacks","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: Terminate all descriptors without callbacks\n\nThe DMA Engine client documentation says in the \"Terminate APIs\" section\nof Documentation/driver-api/dmaengine/client.rst:\n\n\"No callback functions will be called for any incomplete transfers.\"\n\ndw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches\nthe interrupt handler. This schedules a callback for the active descriptor\nand leaves other issued or submitted descriptors queued. A late callback\nafter dmaengine_terminate_sync() can dereference client state that has\nalready been freed, while leftover descriptors may later restart into\nreused buffers or leak.\n\nMove all issued and submitted descriptors to the terminated list whenever\ntermination completes. For a pending STOP, do this from both the DONE and\nABORT paths. Complete their cookies in order without scheduling callbacks.\n\nA STOP can remain pending until the running transfer raises an\ninterrupt. Make device_synchronize() wait for such a pending STOP to\ncomplete before releasing terminated descriptors. Reuse it from\nfree_chan_resources(), then release the remaining virt-dma resources.\nSleep instead of busy-polling while waiting, and warn if the existing\ntimeout expires.","score":8.8,"severity":"high","published":"2026-09-17T16:10:34.911Z","modified":"2026-10-30T12:35:46.423Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf","status":"affected","lessThan":"da56839aced48ecb70033962d7ea98f55b0c5656","versionType":"git"},{"version":"e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf","status":"affected","lessThan":"65e387b95d3855aa894ac729e1778e5bcb9083cb","versionType":"git"},{"version":"e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf","status":"affected","lessThan":"4793f9099a1cadf4e37f3a03d524af6bce88a0ea","versionType":"git"},{"version":"e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf","status":"affected","lessThan":"be87d86537de7ea6fd025f41033d2faff880973f","versionType":"git"},{"version":"e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf","status":"affected","lessThan":"f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7","versionType":"git"},{"version":"e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf","status":"affected","lessThan":"99109a51efd28c9a661fbfb9469b023c517b31d1","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-93042"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"5.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.3","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-93042"}],"remediation":[],"references":["https://git.kernel.org/stable/c/da56839aced48ecb70033962d7ea98f55b0c5656","https://git.kernel.org/stable/c/65e387b95d3855aa894ac729e1778e5bcb9083cb","https://git.kernel.org/stable/c/4793f9099a1cadf4e37f3a03d524af6bce88a0ea","https://git.kernel.org/stable/c/be87d86537de7ea6fd025f41033d2faff880973f","https://git.kernel.org/stable/c/f3ec6702a1d216be61f692cc0a983d6c8fb5ebf7","https://git.kernel.org/stable/c/99109a51efd28c9a661fbfb9469b023c517b31d1"],"sources":[{"name":"CVE","id":"CVE-2026-93042","modified":"2026-10-30T12:35:46.423Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93042"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-30T13:54:41.008Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:00:32.242Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}