CVE-2026-72146

dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

State: Published
Severity: 8.4 High
Published: Aug 15, 2026
Updated: Aug 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also lead to issues.

Request the interrupts only after everything is set up. To keep the error path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5000d37042a61ca556fde2782ca40dbfa802ea16 to before d24d53323e817d79a4bd111bd10b34dbc96e64a8Affected 5000d37042a61ca556fde2782ca40dbfa802ea16 to before 0e0c5b3cf374ebf3c589741751e1fbc67f53ec2fAffected 5000d37042a61ca556fde2782ca40dbfa802ea16 to before 5b12de6229d662864ee22c11d4876652b40120f0Affected 5000d37042a61ca556fde2782ca40dbfa802ea16 to before 2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93Affected 5000d37042a61ca556fde2782ca40dbfa802ea16 to before ec9f66c91bffdb69d309bae6dfb387562db7ebc8Affected 5000d37042a61ca556fde2782ca40dbfa802ea16 to before 07ae600bd353b22f31a8f1007269744fafc7f123Affected 5000d37042a61ca556fde2782ca40dbfa802ea16 to before 731712403ddb39d1a76a11abf339a0615bc85de7Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5000d37042a61ca556fde2782ca40dbfa802ea16 to before d24d53323e817d79a4bd111bd10b34dbc96e64a8Affected
5000d37042a61ca556fde2782ca40dbfa802ea16 to before 0e0c5b3cf374ebf3c589741751e1fbc67f53ec2fAffected
5000d37042a61ca556fde2782ca40dbfa802ea16 to before 5b12de6229d662864ee22c11d4876652b40120f0Affected
5000d37042a61ca556fde2782ca40dbfa802ea16 to before 2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93Affected
5000d37042a61ca556fde2782ca40dbfa802ea16 to before ec9f66c91bffdb69d309bae6dfb387562db7ebc8Affected
5000d37042a61ca556fde2782ca40dbfa802ea16 to before 07ae600bd353b22f31a8f1007269744fafc7f123Affected
5000d37042a61ca556fde2782ca40dbfa802ea16 to before 731712403ddb39d1a76a11abf339a0615bc85de7Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.