EUVD-2026-80602
GHSA-2hx9-3cqh-fcjj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only via tracefs (AV:L); deterministic injection (AC:L); tracefs inject requires root (PR:H); stale-pointer deref crashes kernel with no leak, so C:N/I:L/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: fsl-edma: tracing: no ptr dereference during log output
The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid.
Event injection can be used to trigger a crash:
$ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace
The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
AnalysisAI
Denial of service in the Linux kernel's fsl-edma DMA engine driver lets a local user with write access to tracefs event-injection files crash the system by causing the fsl_edma trace event handler to dereference a stale struct fsl_edma_engine pointer. Affected systems are those running NXP/Freescale eDMA hardware (for example i.MX or Layerscape) with kernel tracing enabled; the independent assessment rates this as a local DoS requiring root/CAP_SYS_ADMIN (assessed CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), which is narrower than the vendor's 7.8 score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local write access to the debugfs/tracefs interface at /sys/kernel/tracing (specifically the fsl_edma event 'inject' file) plus a system running the fsl-edma dmaengine driver - i.e., NXP/Freescale eDMA hardware such as i.MX or Layerscape SoCs with kernel tracing (CONFIG_FTRACE/tracefs) mounted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a locally-triggerable denial-of-service, not a remote or memory-disclosure threat, despite the vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux kernel 6.12.110, 6.18.51, 7.2.5, or 7.3-rc1 (or a later stable/mainline release containing the fsl-edma fix); corresponding upstream commits are d382aaf5fed38c6dd2e0cc710d97cb81d660ffa7, ef02cd3807f39ae1dbc924788d8fa6a85334c435, 2a3801ae5c344473e648006c5b03a9216ac54a6a, and 2ea04dca8e627f722caa7a2037cfbae0257f3501, with advisory links at https://git.kernel.org/stable/c/d382aaf5fed38c6dd2e0cc710d97cb81d660ffa7 and https://nvd.nist.gov/vuln/detail/CVE-2026-89994. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running on NXP/Freescale eDMA hardware, especially i.MX and Layerscape platforms, and determine whether kernel tracing is enabled; restrict write access to tracefs event-injection files to essential root/CAP_SYS_ADMIN users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today