CVE-2026-93170 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify the presence of the fix, as the vulnerability could lead to system instability or denial of service.

Why it matters

CVE-2026-93170 is a vulnerability in the Linux kernel's dmaengine xilinx_dma AXIDMA and MCDMA interrupt handlers that could lead to incorrect channel idle state management, causing spurious transfers and potential descriptor corruption or missed completions. Linux kernel maintainers and users should assess exposure and verify the presence of the fix.

• Verify Linux kernel versions and configurations for exposure to the vulnerability
• Assess the risk of system instability or denial of service due to incorrect channel idle state management
• Monitor system logs for signs of spurious transfers or descriptor corruption
• Prioritize verification of the fix in the Linux kernel codebase

Technical summary

The Linux kernel's dmaengine xilinx_dma AXIDMA and MCDMA interrupt handlers have a race condition that could lead to incorrect channel idle state management. This occurs when multiple descriptors are queued and active, an interrupt fires after completing some descriptors, and the channel is marked idle even though active_list still contains unprocessed descriptors. This results in spurious transfers and potential descriptor corruption or missed completions. The issue has been resolved in the Linux kernel codebase, but specific affected or fixed versions are not detailed in the CVE record or NVD entry.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the presence of the fix, as the vulnerability could lead to system instability or denial of service.

Recommended defensive actions

• Review Linux kernel versions and configurations for exposure to the vulnerability
• Verify the presence of the fix in the Linux kernel codebase
• Monitor system logs for signs of spurious transfers or descriptor corruption
• Assess the risk of system instability or denial of service due to incorrect channel idle state management
• Prioritize verification of the fix in the Linux kernel codebase
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed versions. The Linux kernel community has resolved the issue. Defenders should verify Linux kernel versions and configurations for exposure, assess the risk of system instability or denial of service, and monitor system logs for signs of spurious transfers or descriptor corruption. Evidence is limited to CVE and NVD entries, with additional details from Linux kernel commit records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.