HIGH Introduced in 6.10
fsl-edma TraceEvent Deref
CVE-2026-89994
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid. Event injection can be used to trigger a crash: $ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the fsl-edma tracing subsystem where a stale pointer to a struct fsl_edma_engine is dereferenced during trace log output. A local user with access to the tracing infrastructure can trigger a kernel crash by injecting trace events and reading the trace buffer. This primarily affects availability on systems with the fsl-edma DMA driver and tracing enabled.
Vulnerability analysis
The fsl-edma trace events store a raw pointer to the DMA engine structure in the trace ring buffer. When the trace log is later printed (e.g., by reading the trace file), the code dereferences that pointer to compute a register offset. By that time, the underlying structure may have been freed, resulting in a use-after-free dereference. The fix captures the needed membase value at event creation time and stores it directly in the trace record, so log output no longer dereferences a potentially stale pointer. The vulnerable path is reachable from a local shell with access to the tracing sysfs interface, specifically on systems with the fsl-edma DMA driver loaded and tracing support enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.10 | 7.2.5 | 2a3801ae5c34 |
| mainline | 6.10 | 7.3-rc1 | 2ea04dca8e62 |
| 6.18 | 6.10 | 6.18.51 | d382aaf5fed3 |
| 6.12 | 6.10 | 6.12.110 | ef02cd3807f3 |
| cip/6.12 | 6.10 | 6.12.111-cip32 | ef02cd3807f3 |