CVE-2026-72148 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the dmaengine dw-edma should be aware of this vulnerability and apply the patch to prevent potential race conditions. System administrators and security teams responsible for Linux-based systems should review their deployments to determine if they are affected and prioritize patching. Additionally, developers working on similar DMA engine implementations should consider the security implications of non-atomic register updates and take appropriate precautions.

Technical summary

The vulnerability is caused by the lack of atomicity in the read-modify-write sequence of the DONE_INT_MASK and ABORT_INT_MASK registers in the Linux kernel's dmaengine dw-edma. This can lead to race conditions when multiple channels update these registers simultaneously. The fix is to add a spinlock to serialize access to these registers, preventing race conditions and potential system instability. This change ensures that only one channel can modify these registers at a time, maintaining the integrity of DMA operations.

Defensive priority

The vulnerability has a high defensive priority due to its potential to cause race conditions and instability in the system.

Recommended defensive actions

• Apply the patch to add a spinlock to serialize access to the DONE_INT_MASK and ABORT_INT_MASK registers
• Review the Linux kernel source code for similar vulnerabilities
• Monitor the system for potential race conditions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The evidence for this vulnerability comes from the Linux kernel source code and the NVD database. The vulnerability was resolved by adding a spinlock to protect the DONE_INT_MASK and ABORT_INT_MASK registers. However, the exact scope of affected systems and potential impact on various deployments is not explicitly stated in the provided sources. Defenders should verify the affected Linux kernel versions and configurations to assess their exposure. Additionally, reviewing system logs and monitoring for unusual DMA engine behavior can help detect potential exploitation attempts.

Official resources