CVE-2026-93042

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

On DesignWare PCIe endpoint SoCs the host starts eDMA via pci_epf_mhi_edma_read()/write() (MHI transfers ≥4K), nvmet_pci_epf_dma_transfer(), or pci_epf_test BAR COMMAND_READ|WRITE with FLAG_USE_DMA, then those clients call dmaengine_terminate_sync() on the local dw-edma channel; the trigger is PCIe-link peer traffic, not a local syscall or a routable protocol.

AC:LAttack complexity, low

pci_epf_mhi_edma_read() waits only 1000ms then calls dmaengine_terminate_sync(); a host that issues a ≥4K MHI DMA and stalls it hits that timeout while EDMA_ST_BUSY. Vulnerable dw_edma_device_terminate_all() only stores EDMA_REQ_STOP and returns 0 because device_synchronize was unimplemented, so the host can drop the stall and deliver the DONE/ABORT IRQ itself.

PR:NPrivileges required, none

pci_epf_mhi_edma_read()/write() and nvmet_pci_epf_dma_transfer() do not authenticate the PCIe host; MHI TREs, NVMe I/O, or BAR command-register COMMAND_READ/WRITE writes from the upstream port suffice, with no Linux uid, capability, or user-namespace check on the endpoint.

UI:NUser interaction, none

The PCIe host starts the MHI/NVMe/epf-test DMA and forces the client's terminate-on-timeout path itself; no victim mount, file open, or other interactive step is required once the endpoint function is already bound.

S:UScope, unchanged

The late vchan_complete() callback UAF and leftover desc_issued restarts corrupt callback state and DMA buffers inside the same endpoint kernel that hosts dw-edma; that is in-kernel memory corruption, not a KVM/Xen guest escape or an IOMMU policy bypass.

C:HConfidentiality impact, high

dw_edma_done_interrupt()'s EDMA_REQ_STOP path calls vchan_cookie_complete(), so vchan_complete() can invoke pci_epf_mhi_dma_callback() after pci_epf_mhi_edma_read() returned and its DECLARE_COMPLETION_ONSTACK died; leftover issued descriptors can also dw_edma_start_transfer() MEM_TO_DEV from reused kernel pages into host memory.

I:HIntegrity impact, high

After dma_unmap_single() in the MHI/nvmet timeout path, leftover desc_issued entries stay queued, so a later issue_pending() runs dw_edma_start_transfer() DEV_TO_MEM into those unmapped/reused pages, and the late callback UAF likewise corrupts kernel state, giving a write primitive.

A:HAvailability impact, high

The STOP-path vchan_cookie_complete() UAF in vchan_complete() and DMA into buffers already unmapped by pci_epf_mhi_edma_read() or nvmet_pci_epf_dma_transfer() oops or panic the endpoint kernel, as the fix commit describes for a late callback after dmaengine_terminate_sync().