CVE-2026-93170 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify kernel configurations and updates to address this vulnerability. Affected operators, platforms, and security teams should prioritize patch application and monitor for potential descriptor corruption or missed completions. Vulnerability management and security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A race condition vulnerability in the Linux kernel's dmaengine xilinx_dma AXIDMA and MCDMA interrupt handlers could allow a channel to be incorrectly marked as idle, leading to spurious transfers and potential descriptor corruption or missed completions. Linux kernel maintainers and users should assess exposure and verify the integrity of their kernel configurations and updates.

• Verify kernel configurations and updates for dmaengine xilinx_dma usage
• Monitor for potential descriptor corruption or missed completions
• Assess exposure and prioritize patch application

Technical summary

The Linux kernel dmaengine xilinx_dma AXIDMA and MCDMA interrupt handlers have a race condition vulnerability. When multiple descriptors are queued and active, an interrupt may fire after completing some descriptors, causing the channel to be incorrectly marked as idle. This leads to premature transfer attempts and potential descriptor corruption or missed completions. The vulnerability affects the dmaengine xilinx_dma component of the Linux kernel, specifically the AXIDMA and MCDMA interrupt handlers, and can be addressed by verifying kernel configurations and updates.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the integrity of their kernel configurations and updates.

Recommended defensive actions

• Review kernel configurations and updates for dmaengine xilinx_dma usage
• Verify the integrity of kernel Git commits and patch application
• Monitor for potential descriptor corruption or missed completions
• Assess exposure and prioritize patch application
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed versions. Official kernel Git commit references are provided. The vulnerability affects the Linux kernel's dmaengine xilinx_dma component, specifically the AXIDMA and MCDMA interrupt handlers. The issue arises from a race condition that can lead to incorrect channel state management. Defenders should verify kernel configurations, updates, and monitor for potential descriptor corruption or missed completions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.