Linux dw-edma: callbacks fire for terminated transfers, dereferencing freed client state

Impact

The DMAEngine contract says no callback runs for an incomplete transfer after termination, but dw-edma called vchan_cookie_complete() when a deferred STOP reached the interrupt handler - scheduling a callback for the active descriptor and leaving other issued descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, and leftover descriptors can later restart into reused buffers or leak. This is the DesignWare embedded DMA engine used behind PCIe endpoints and bridges; exposure in a datacenter depends on having a driver that uses it, and it is reached through kernel-internal DMA clients rather than directly by a tenant. Where it is in use, the outcome is host-side use-after-free and DMA into recycled buffers, not something an operator can detect from userspace.

Who can reach it

Not tenant-facing. Triggered by in-kernel DMA clients of the dw-edma engine performing terminate/teardown while a transfer is in flight - device removal, driver unbind, or error recovery on hardware using DesignWare eDMA. Local and privileged at best.

What to do

Take a stable kernel containing the fix (all issued and submitted descriptors moved to the terminated list, cookies completed without callbacks, device_synchronize() waiting for a pending STOP) and reboot the affected nodes. No configuration-level mitigation is described.

References

Related entries

• QEMU 9pfs: use-after-free race between Tlcreate and Twalk lets a guest escape the shared directory to host filesCVE-2026-93834 · QEMU 9pfs (virtio-9p shared directory, Tlcreate/Twalk race)High
• Linux kernel nvme-fc: error recovery iterates an uninitialized IO tagset when admin connect times outCVE-2026-97409 · Linux kernel nvme-fc (requests cancelled in an uninitialized IO tagset during CONNECTING error recovery)High
• Linux kernel qla2xxx: unserialized NVMe-FC unsolicited-context list can be corrupted by concurrent add and deleteCVE-2026-97527 · Linux kernel scsi qla2xxx (fcport->unsol_ctx_head list unserialized across ISR, DPC and NVMe-FC callbacks)High
• Linux kernel qla2xxx: NVMe-FC unsolicited context freed while still linked, leaving a freed node on the listCVE-2026-97528 · Linux kernel scsi qla2xxx (uctx freed without list_del() on qla_nvme_xmt_ls_rsp() error path)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High