VulnerabilityPublished 17 Sep 2026Updated 19 Oct 2026

CVE-2026-93040: Linux kernel · dmaengine: dw-edma: Serialize channel state checks

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fe0ffa0190e862ed71e8c1a476090f648c9cb7d9 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fe0ffa0190e862ed71e8c1a476090f648c9cb7d9, f7d1619f3e10c619b62c6cd6d95371b5c526c85a, da16a02f0998a0d455ce6265b836b29ad92e6e58 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < fe0ffa0190e862ed71e8c1a476090f648c9cb7d9	Fixed in fe0ffa0190e862ed71e8c1a476090f648c9cb7d9
LinuxLinux	Affected ≥ e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < f7d1619f3e10c619b62c6cd6d95371b5c526c85a	Fixed in f7d1619f3e10c619b62c6cd6d95371b5c526c85a
LinuxLinux	Affected ≥ e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < da16a02f0998a0d455ce6265b836b29ad92e6e58	Fixed in da16a02f0998a0d455ce6265b836b29ad92e6e58
LinuxLinux	Affected ≥ e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < be0072af8ce6e9458cc586e0e8b41a251e7d4316	Fixed in be0072af8ce6e9458cc586e0e8b41a251e7d4316
LinuxLinux	Affected ≥ e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < b6293a8a38f4d5866ce1a264c138265a02e4c53a	Fixed in b6293a8a38f4d5866ce1a264c138265a02e4c53a
LinuxLinux	Affected ≥ e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf, < 3001cfcee30dcc81f8b3774319c12067f126e49a	Fixed in 3001cfcee30dcc81f8b3774319c12067f126e49a

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause() and resume() read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks so that request, status, and configured stay consistent. For example, pause() can observe EDMA_ST_BUSY right before the interrupt handler completes the final descriptor and moves the channel to EDMA_ST_IDLE, and then record EDMA_REQ_PAUSE on an already idle channel. No further interrupt will acknowledge the request, and since issue_pending() requires EDMA_REQ_NONE, the channel is wedged for good: terminate_all() leaves the stale request behind, so even reconfiguring the channel does not recover it. issue_pending() already runs under vc.lock, but it tests configured before taking it. Move that test under the lock as well, so configured, request, and status are evaluated as one channel-state snapshot.

References

Community reviews

Loading reviews…