Riskcovery

CVE-2026-89994

dmaengine: fsl-edma: tracing: no ptr dereference during log output

State
Published
Severity
7.8 High
Published
Sep 16, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fsl-edma: tracing: no ptr dereference during log output

The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid.

Event injection can be used to trigger a crash:

$ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace

The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 11102d0c343ba06ddd303f2503c0ce46d70052f2 to before ef02cd3807f39ae1dbc924788d8fa6a85334c435Affected
  • 11102d0c343ba06ddd303f2503c0ce46d70052f2 to before d382aaf5fed38c6dd2e0cc710d97cb81d660ffa7Affected
  • 11102d0c343ba06ddd303f2503c0ce46d70052f2 to before 2a3801ae5c344473e648006c5b03a9216ac54a6aAffected
  • 11102d0c343ba06ddd303f2503c0ce46d70052f2 to before 2ea04dca8e627f722caa7a2037cfbae0257f3501Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.51 through 6.18.*Not affected
  • 7.2.5 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.