EUVD-2026-93309
GHSA-wrvr-2vch-mjpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access
-
DeliveryInvoke pxad DMA descriptor allocation
-
ExploitTrigger doubled nb_desc counter
-
ExecutionForce free of unallocated descriptors
-
PersistCorrupt kernel heap
-
ImpactEscalate privileges or crash kernel
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires local access to a Linux system using the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and the ability to trigger hardware-descriptor allocation via a consuming DMA client. Critically, the bug only exists in kernels compiled with gcc 15.1+ or clang 22.1+, where __builtin_counted_by_ref() causes kzalloc_flex() to set the __counted_by counter, so the loop's increment double-counts nb_desc - kernels built with older toolchains are not affected. Limiting factors: local-only access (AV:L), a low-privilege account capable of initiating DMA operations (PR:L), the specific PXA platform/driver, and the recent-compiler build precondition; no remote or network exposure. |
| Impact | Signals are consistent and point to a genuine-but-niche local kernel memory-corruption flaw rather than an urgent mass-exploitation priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates a local, low-privilege, no-interaction attack with full confidentiality/integrity/availability impact - typical of a kernel heap-corruption bug. EPSS is very low at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent widespread exploitation. The local-only attack vector (AV:L) and the fact that the bug only manifests on kernels built with gcc >= 15.1 or clang >= 22.1 (where __builtin_counted_by_ref() exists) materially narrow the exploitable population. One notable data inconsistency: the input Tags label this 'Information Disclosure', but the description (double-counted descriptor count causing pxad_free_desc() to free entries that were never allocated) and the I:H/A:H impact describe heap corruption / invalid free, not primarily information disclosure - treat the tag with skepticism. Net: a real, patch-worthy local flaw but low real-world priority outside affected PXA-based systems. |
| Exploit ScenarioDerived | A local, low-privileged user on a PXA-platform Linux system built with a recent compiler triggers DMA descriptor allocation through a driver that uses the pxad engine, causing nb_desc to be double-counted. On the allocation error path or during pxad_free_desc(), the kernel frees descriptor entries that were never allocated, producing heap corruption that could be shaped toward privilege escalation or a crash. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Apply the upstream fix by upgrading to a kernel containing commit f6504be006aa4bb4bd26285f410a885c17920d65 (mainline) or the stable backport 1de93785f32b450e9eae1e4fcfb7d03eb49eb27e; vendor-released patched versions are recorded as Linux 7.2.8 and 7.3-rc4, so distributions should pick up their respective 7.2.x/7.3-rc stable updates - advisory and patch links are https://git.kernel.org/stable/c/f6504be006aa4bb4bd26285f410a885c17920d65 and https://git.kernel.org/stable/c/1de93785f32b450e9eae1e4fcfb7d03eb49eb27e. The fix explicitly sets nb_desc instead of incrementing it and lowers the counter on the error path so pxad_free_desc() only walks descriptors that were actually allocated. Where patching must be deferred, effective compensating controls are limited because the driver is built into PXA platform kernels: removing the module or rebuilding the kernel without CONFIG_PXA_DMA (or blacklisting the pxad platform binding) eliminates the attack surface entirely but disables DMA on PXA peripherals that depend on this engine, which may break storage, audio, or serial functionality; alternatively, rebuilding the same source with a toolchain older than gcc 15.1 or clang 22.1 avoids the implicit __counted_by counter write-back and therefore the double count, at the cost of forgoing the hardening that kzalloc_flex() provides and being a temporary workaround rather than a fix. Restricting local interactive access to trusted users reduces the PR:L vector but does not remove the underlying corruption, and there is no meaningful network-side mitigation since the issue is local-only (AV:L).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The PXA dmaengine driver allocates a flexible-array software descriptor wrapper (struct pxad_desc_sw) whose trailing hw_desc array is sized by nb_hw_desc. The allocation was migrated from kzalloc(struct_size(...)) to kzalloc_flex(), which is designed to write the element count back into a __counted_by() annotated member (sw_desc->nb_desc) - but only on compilers that expose __builtin_counted_by_ref(), i.e. gcc 15.1+ or clang 22.1+. The original loop that increments nb_desc for each hardware descriptor was left in place, so on modern toolchains the counter is advanced twice per descriptor: once implicitly by kzalloc_flex() and once explicitly by the loop. nb_desc is the bound used by pxad_free_desc() when iterating and by set_updater_desc() when indexing, so an inflated count yields both out-of-bounds indexing and freeing of array entries beyond the allocated region. In practice this manifests as kernel memory corruption (the input assigns no CWE, but the defect class is incorrect resource/bound accounting leading to out-of-bounds access and invalid free), and the error path is equally affected unless the counter is explicitly reduced to the number of descriptors actually allocated. Kernels built with older toolchains do not set the counter implicitly and are therefore not vulnerable, which makes exploitability tightly coupled to the build environment and to the hardware platform.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel driver reachable by a low-privileged user triggering DMA allocation (AV:L/PR:L); heap corruption from invalid free yields full memory compromise (C/I/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: pxa: fix double counting of the hw descriptors
pxad_alloc_desc() was converted from
kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)
to kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc itself - but only where the compiler has __builtin_counted_by_ref(), so from gcc 15.1 or clang 22.1 on. The loop below it still increments nb_desc, which makes it come out doubled there and correct elsewhere.
nb_desc is what pxad_free_desc() iterates over and what set_updater_desc() indexes from, so set it explicitly and drop the increment. The error path has to lower it to the number of descriptors allocated so far, otherwise pxad_free_desc() would free entries that were never allocated.
Executive ViewAI
A memory-corruption flaw in the Linux kernel's Marvell PXA DMA engine driver (pxad) allows a low-privileged local user to corrupt kernel memory, potentially gaining full control of an affected device with complete loss of data confidentiality, integrity, and availability. Exposure is narrow but non-zero: only systems that both run the PXA dmaengine driver (CONFIG_PXA_DMA) and were compiled with gcc 15.1, clang 22.1, or newer are affected, which typically means embedded, industrial, or legacy ARM hardware rather than mainstream data-center servers. Leadership should care because devices matching that profile would be fully compromised by any user who already has a local account, and a vendor patch is already available, making this a governance and inventory question rather than a research one.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB