VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-93168: Linux kernel · dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

Source GCVE Database

Compare

Authoritative record:CVE-2026-93168· Medium

Not known to be exploited · fixed in f786e7b3adbf3bd14964a1cedf9d55b6ad91dcd7 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 18:03 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f786e7b3adbf3bd14964a1cedf9d55b6ad91dcd7, c30a26d4987a01e619449bf170f584c007e07d75, aa99c4d1d63bbc26a5fc4c667d89b2595743c19d +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-r3mw-x3xp-fjpr

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 9495f2648287029fb5545c34a0fa318426ebe84c, < f786e7b3adbf3bd14964a1cedf9d55b6ad91dcd7	Fixed in f786e7b3adbf3bd14964a1cedf9d55b6ad91dcd7
LinuxLinux	Affected ≥ 9495f2648287029fb5545c34a0fa318426ebe84c, < c30a26d4987a01e619449bf170f584c007e07d75	Fixed in c30a26d4987a01e619449bf170f584c007e07d75
LinuxLinux	Affected ≥ 9495f2648287029fb5545c34a0fa318426ebe84c, < aa99c4d1d63bbc26a5fc4c667d89b2595743c19d	Fixed in aa99c4d1d63bbc26a5fc4c667d89b2595743c19d
LinuxLinux	Affected ≥ 9495f2648287029fb5545c34a0fa318426ebe84c, < 4237b5cc181a17f5a2a797655c1ce2c64e01c550	Fixed in 4237b5cc181a17f5a2a797655c1ce2c64e01c550
LinuxLinux	Affected ≥ 9495f2648287029fb5545c34a0fa318426ebe84c, < 8b5654d317277e6e505c23f8fa7e415237fefc7f	Fixed in 8b5654d317277e6e505c23f8fa7e415237fefc7f
LinuxLinux	Affected ≥ 9495f2648287029fb5545c34a0fa318426ebe84c, < 2ba67aa183a3ce174d534425b67eda84f6e3c896	Fixed in 2ba67aa183a3ce174d534425b67eda84f6e3c896

AI-suggested

A fix is available that changes the delay_us parameter in xilinx_dma_poll_timeout from 0 to 10 microseconds, preventing prolonged CPU busy-waiting and stalls. Users should apply the patch that introduces the XILINX_DMA_POLL_DELAY_US constant and updates the polling logic accordingly. No other mitigation actions are indicated.

Description

A vulnerability in the Linux kernel's xilinx_dma driver causes the CPU to stall due to a busy-wait loop when xilinx_dma_poll_timeout is called with delay_us=0 and the condition never fulfills. This results in a prolonged CPU busy-wait lasting several minutes instead of timing out promptly. The issue arises from an underestimation of wall clock time in poll_timeout_us_atomic after a kernel commit changed timing behavior. The fix involves setting delay_us to a non-zero value (10 microseconds) to prevent CPU stalls while keeping DMA transfer startup delay minimal.

Impact

The vulnerability causes the CPU to stall by busy-waiting for an unexpectedly long time (several minutes) when a DMA polling timeout condition is never met with delay_us=0. This can degrade system responsiveness and performance, potentially impacting systems using the xilinx_dma driver during DMA operations. There is no indication of code execution or data corruption from this issue.

Summary

The Linux kernel xilinx_dma driver contained a flaw where calling xilinx_dma_poll_timeout with delay_us=0 and an unfulfilled condition caused the CPU to busy-wait excessively, leading to a CPU stall. This was due to a significant underestimation of elapsed wall clock time in poll_timeout_us_atomic, introduced by a prior kernel commit that removed ktime_get usage. The timeout duration was extended from the expected ~XILINX_DMA_LOOP_COUNT microseconds to several minutes. The vulnerability is resolved by introducing a constant XILINX_DMA_POLL_DELAY_US with a value of 10 microseconds for delay_us, ensuring timely timeout and avoiding CPU stalls.

References

Community reviews

Loading reviews…