Skip to main content

Linux Kernel CVE-2026-72149

| EUVDEUVD-2026-58907 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-jjfr-vvvg-vj2f
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.5 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Triggering the DMA hang requires local access and write permission to a Tegra UART device node, so AV:L and PR:L; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:16 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.5 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: tegra: Fix burst size calculation

Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length is not evenly divisible by the configured max burst size, the DMA hangs with partial burst at the end.

Fix this by reducing the burst size to the largest power-of-2 value that evenly divides the transfer length. For example, a 40-byte transfer with a 16-byte max burst will now use an 8-byte burst (40 / 8 = 5 complete bursts) instead of causing a hang.

This issue was observed with the PL011 UART driver where TX DMA transfers of arbitrary lengths were stuck.

AnalysisAI

Tegra GPC DMA driver in the Linux kernel hangs when a client submits a transfer whose length is not evenly divisible by the channel's configured maximum burst size, resulting in a partial-burst stall that freezes the DMA channel indefinitely. The defect is confirmed in production via the PL011 UART TX DMA path on NVIDIA Tegra SoC hardware and affects kernel branches from the introducing commit ee17028009d4 through fixed stable releases spanning 6.1, 6.6, 6.12, 6.18, and 7.1 series. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% (12th percentile) reflects the extremely low real-world exploitation probability, consistent with a hardware-specific driver defect rather than a broadly exploitable software flaw.

Technical ContextAI

The Tegra General Purpose DMA (GPC DMA) controller, used in NVIDIA Tegra SoCs (e.g., Jetson platforms), enforces a hardware constraint that each transfer must be an exact multiple of the channel's configured maximum burst size. The Linux dmaengine/tegra driver failed to enforce this: when a caller such as the PL011 UART driver issued a TX DMA transfer of an arbitrary byte length (e.g., 40 bytes with a 16-byte burst), the hardware could not complete the final partial burst and entered a hung state. The fix computes the largest power-of-two divisor of the requested transfer length and uses that as the effective burst size, guaranteeing that only complete bursts are issued. No CWE is formally assigned, but the root cause class is an improper input validation / arithmetic logic error at the hardware abstraction boundary - specifically, a missing alignment check before DMA descriptor submission. The affected CPE is the Linux kernel across multiple stable branches; the vulnerability was introduced at commit ee17028009d49fffed8cc963455d33b1fd3f1d08.

RemediationAI

Apply the vendor-released stable kernel patches corresponding to your running branch: upgrade to 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 as appropriate; 7.2-rc1 also includes the fix. Patch commits are available at https://git.kernel.org/stable/c/4651df83b6c796daead3447e8fd874322918ee4f (6.1), https://git.kernel.org/stable/c/6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1 (6.6), https://git.kernel.org/stable/c/735951baa311c66353405dcac39375dd66441db0 (6.12), https://git.kernel.org/stable/c/7926c1e4be86379945fb5f168888ac4d2aaf6c91, https://git.kernel.org/stable/c/8f0f5de1091119679d87f60dfb1acbff4b2a0ed3, and https://git.kernel.org/stable/c/a3b76b54e06d73166af4d1a284a0e0711889060c. If patching immediately is not possible, the most targeted workaround is to disable DMA mode for the PL011 UART driver by passing the kernel boot parameter or modifying the device tree to disable DMA for the UART node - this forces PIO (programmed I/O) transfers and eliminates the hang trigger, at the cost of increased CPU utilization for serial I/O. Systems running Linux 5.19 should migrate to a supported stable branch as that series is end-of-life and will not receive a backported fix.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72149 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy