Linux Kernel EUVD-2026-82278

Requires local access to a system running the Linux kernel Xilinx DMA driver (xilinx_dma) in AXIDMA or MCDMA mode - i.e., Xilinx Zynq/ZynqMP/Versal FPGA SoC hardware or equivalent IP with these DMA engines active. Exploitation is not attacker-controlled input but depends on hitting a completion-path race: multiple descriptors must be queued and active simultaneously, and an interrupt must fire after some (but not all) descriptors complete so the channel is marked idle while active_list is still non-empty. Limiting factors: the affected driver/hardware must be present and in use (non-ubiquitous), the condition arises from timing rather than a crafted payload (hard to trigger deterministically), and the attacker needs local privileges to drive DMA activity - there is no remote or network path.

The vendor (Linux) assigns CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but the technical description does not support the AC:L or full C:H/I:H triad. This is an internal race condition in the Xilinx AXIDMA/MCDMA interrupt handlers: after some descriptors complete, the channel is prematurely marked idle and start_transfer() is invoked while active_list still holds unprocessed descriptors, causing spurious transfers and 'descriptor corruption or missed completions.' This is a completion-path timing bug, not an attacker-driven input primitive - it requires a specific interleaving of queued/active descriptors and an interrupt firing mid-processing, which argues for AC:H rather than AC:L. The realistic impact is DMA state corruption / stalled or misdirected transfers (availability, and limited integrity of in-flight DMA data), not a controllable confidentiality read, so C:H is not justified. No EPSS score, no CISA KEV listing, and no public PoC are present in the input; exploitation status is 'no public exploit identified at time of analysis.' Net: this reads as a high-CVSS-but-low-real-risk reliability fix rather than an operational security priority. The 'Information Disclosure' tag conflicts with the description, which points to corruption/DoS with no disclosure vector - verify tag with vendor.

A local workload on a Xilinx Zynq/ZynqMP/Versal SoC drives the AXI DMA or MCDMA engine with multiple queued descriptors so that an interrupt fires while descriptors are still being processed, causing the driver to mark the channel idle and launch a spurious transfer. The resulting descriptor corruption or missed completion can hang or crash the DMA subsystem and any dependent driver. No public exploit code exists, and reliably winning the completion-path race is difficult, making practical weaponization unlikely.