CVE-2026-72148

This vulnerability in the Synopsys DesignWare eDMA driver (dw-edma) stems from a race condition in the channel start routine. The function dw_edma_v0_core_start() performs a read-modify-write sequence on shared hardware registers — specifically DONE_INT_MASK and ABORT_INT_MASK — that control interrupt masking for DMA completions. These registers are shared across all DMA channels in the hardware, but the driver treats each channel as an independent execution context. Under concurrent channel operations, two simultaneous starts or a start interleaved with a completion interrupt can corrupt the mask register, causing one channel's completion to inadvertently mask or unmask another channel's interrupt. The practical impact extends beyond a single failed transfer. When DONE_INT_MASK is corrupted, DMA completions fail to generate interrupts. This leads to unreclaimed buffers, silent data loss in network or storage pipelines, or spurious interrupts that hang event handlers. In production kernels with interrupt-driven DMA callbacks and scheduler-induced timing variations, concurrent channel access isn't an edge case — it's the normal operating state. The fix adds a spinlock to serialize access to dw_edma_v0_core_start(). Check whether your kernel includes this serialization, particularly if you're running a downstream or vendor kernel that may have missed the upstream fix. Audit other DMA drivers for similar patterns: shared control registers accessed non-atomically while the driver model assumes channel independence. The DMAengine framework deliberately leaves synchronization to individual drivers, so this class of bug has recurred across multiple DMA controller families — treat shared-register access in any DMA driver as a high-risk pattern requiring atomic operations or locking. If you're maintaining a custom DMA driver, trace every read-modify-write to shared hardware registers and confirm it's protected against concurrent execution from both tasklet and interrupt contexts.

Reviewed through automated stages and approved by a human before publication.