CVE-2026-98324 (GCVE-0-2026-98324)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
Title
dmaengine: pxa: fix double counting of the hw descriptors
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was converted from kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT) to kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc itself - but only where the compiler has __builtin_counted_by_ref(), so from gcc 15.1 or clang 22.1 on. The loop below it still increments nb_desc, which makes it come out doubled there and correct elsewhere. nb_desc is what pxad_free_desc() iterates over and what set_updater_desc() indexes from, so set it explicitly and drop the increment. The error path has to lower it to the number of descriptors allocated so far, otherwise pxad_free_desc() would free entries that were never allocated.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6633 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 69050f8d6d075dc01af7a5f2f550a8067510366f , < 1de93785f32b450e9eae1e4fcfb7d03eb49eb27e (git)
Affected: 69050f8d6d075dc01af7a5f2f550a8067510366f , < f6504be006aa4bb4bd26285f410a885c17920d65 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/pxa_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1de93785f32b450e9eae1e4fcfb7d03eb49eb27e",
              "status": "affected",
              "version": "69050f8d6d075dc01af7a5f2f550a8067510366f",
              "versionType": "git"
            },
            {
              "lessThan": "f6504be006aa4bb4bd26285f410a885c17920d65",
              "status": "affected",
              "version": "69050f8d6d075dc01af7a5f2f550a8067510366f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/pxa_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: pxa: fix double counting of the hw descriptors\n\npxad_alloc_desc() was converted from\n\n        kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)\n\nto kzalloc_flex(), which sets the __counted_by() counter sw_desc-\u003enb_desc\nitself - but only where the compiler has __builtin_counted_by_ref(), so\nfrom gcc 15.1 or clang 22.1 on. The loop below it still increments\nnb_desc, which makes it come out doubled there and correct elsewhere.\n\nnb_desc is what pxad_free_desc() iterates over and what\nset_updater_desc() indexes from, so set it explicitly and drop the\nincrement. The error path has to lower it to the number of descriptors\nallocated so far, otherwise pxad_free_desc() would free entries that were\nnever allocated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The fault is in pxad_alloc_desc()/set_updater_desc() in drivers/dma/pxa_dma.c and is triggered by any local I/O that makes a PXA DMA client prep a transfer, e.g. read() on SD/MMC storage via pxamci -\u003e dmaengine_prep_slave_sg() -\u003e pxad_prep_slave_sg(). No remote protocol supplies the bad state.\nAC:L - On builds with gcc\u003e=15.1 or clang\u003e=22.1 (the current default toolchains), kzalloc_flex() already sets nb_desc=N and the loop\u0027s nb_desc++ makes it 2N on every allocation, so every DMA prep overruns hw_desc[]. Controlling the out-of-bounds slot only needs ordinary slab grooming of the neighbouring kmalloc object.\nPR:L - An unprivileged local user can start the vulnerable path just by reading a file on PXA MMC-backed storage (or using SPI/audio devices that use pxa_dma). No capability check sits between the read and pxad_prep_slave_sg().\nUI:N - The attacker drives the I/O that leads to pxad_alloc_desc() and set_updater_desc() through their own syscalls. No victim action is needed.\nS:U - Corruption stays within kernel slab and dma_pool memory under the same kernel authority, with no VM or IOMMU boundary crossed.\nC:H - set_updater_desc(), is_desc_completed() and pxad_residue() read pointers from hw_desc[2N-1] and hw_desc[2N-2], past the kzalloc_flex allocation into adjacent slab memory, and dereference them. A groomed neighbouring object gives a pointer-controlled read.\nI:H - set_updater_desc() writes ddadr/dsadr/dtadr/dcmd (16 bytes) through the out-of-bounds pointer hw_desc[nb_desc-1], and pxad_free_desc() calls dma_pool_free() on up to N out-of-bounds pointers. With a groomed neighbour this is a controlled-address write plus an invalid free.\nA:H - Every pxa_dma transfer dereferences pointers past the allocation and frees nonexistent dma_pool entries in pxad_free_desc(), causing an oops or pool corruption on the first MMC/SPI DMA."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:50:04.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1de93785f32b450e9eae1e4fcfb7d03eb49eb27e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6504be006aa4bb4bd26285f410a885c17920d65"
        }
      ],
      "title": "dmaengine: pxa: fix double counting of the hw descriptors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98324",
    "datePublished": "2026-10-06T08:46:17.919Z",
    "dateReserved": "2026-09-25T10:25:14.340Z",
    "dateUpdated": "2026-10-07T06:50:04.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98324",
      "date": "2026-10-08",
      "epss": "0.00129",
      "percentile": "0.02193"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/pxa_dma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1de93785f32b450e9eae1e4fcfb7d03eb49eb27e",
                    "status": "affected",
                    "version": "69050f8d6d075dc01af7a5f2f550a8067510366f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f6504be006aa4bb4bd26285f410a885c17920d65",
                    "status": "affected",
                    "version": "69050f8d6d075dc01af7a5f2f550a8067510366f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/pxa_dma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: pxa: fix double counting of the hw descriptors\n\npxad_alloc_desc() was converted from\n\n        kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)\n\nto kzalloc_flex(), which sets the __counted_by() counter sw_desc-\u003enb_desc\nitself - but only where the compiler has __builtin_counted_by_ref(), so\nfrom gcc 15.1 or clang 22.1 on. The loop below it still increments\nnb_desc, which makes it come out doubled there and correct elsewhere.\n\nnb_desc is what pxad_free_desc() iterates over and what\nset_updater_desc() indexes from, so set it explicitly and drop the\nincrement. The error path has to lower it to the number of descriptors\nallocated so far, otherwise pxad_free_desc() would free entries that were\nnever allocated."
          }
        ],
        "id": "CVE-2026-98324",
        "lastModified": "2026-10-07T07:17:09.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:24.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1de93785f32b450e9eae1e4fcfb7d03eb49eb27e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f6504be006aa4bb4bd26285f410a885c17920d65"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-08T16:47:33Z",
      "cve": "CVE-2026-98324",
      "id": "CVE-2026-98324",
      "initial_release_date": "2026-10-08T16:47:33Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98324",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98324.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.