CVE-2025-71221 (GCVE-0-2025-71221)
Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-02-16 08:58
VLAI?
Title
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
Add proper locking in mmp_pdma_residue() to prevent use-after-free when
accessing descriptor list and descriptor contents.
The race occurs when multiple threads call tx_status() while the tasklet
on another CPU is freeing completed descriptors:
CPU 0 CPU 1
----- -----
mmp_pdma_tx_status()
mmp_pdma_residue()
-> NO LOCK held
list_for_each_entry(sw, ..)
DMA interrupt
dma_do_tasklet()
-> spin_lock(&desc_lock)
list_move(sw->node, ...)
spin_unlock(&desc_lock)
| dma_pool_free(sw) <- FREED!
-> access sw->desc <- UAF!
This issue can be reproduced when running dmatest on the same channel with
multiple threads (threads_per_chan > 1).
Fix by protecting the chain_running list iteration and descriptor access
with the chan->desc_lock spinlock.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/mmp_pdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9f665b3c3d9a168410251f27a5d019b7bf93185c",
"status": "affected",
"version": "1b38da264674d6a0fe26a63996b8f88b88c3da48",
"versionType": "git"
},
{
"lessThan": "a143545855bc2c6e1330f6f57ae375ac44af00a7",
"status": "affected",
"version": "1b38da264674d6a0fe26a63996b8f88b88c3da48",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/mmp_pdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.10",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()\n\nAdd proper locking in mmp_pdma_residue() to prevent use-after-free when\naccessing descriptor list and descriptor contents.\n\nThe race occurs when multiple threads call tx_status() while the tasklet\non another CPU is freeing completed descriptors:\n\nCPU 0 CPU 1\n----- -----\nmmp_pdma_tx_status()\nmmp_pdma_residue()\n -\u003e NO LOCK held\n list_for_each_entry(sw, ..)\n DMA interrupt\n dma_do_tasklet()\n -\u003e spin_lock(\u0026desc_lock)\n list_move(sw-\u003enode, ...)\n spin_unlock(\u0026desc_lock)\n | dma_pool_free(sw) \u003c- FREED!\n -\u003e access sw-\u003edesc \u003c- UAF!\n\nThis issue can be reproduced when running dmatest on the same channel with\nmultiple threads (threads_per_chan \u003e 1).\n\nFix by protecting the chain_running list iteration and descriptor access\nwith the chan-\u003edesc_lock spinlock."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-16T08:58:43.554Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c"
},
{
"url": "https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7"
}
],
"title": "dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71221",
"datePublished": "2026-02-14T16:27:04.631Z",
"dateReserved": "2026-02-14T16:26:02.969Z",
"dateUpdated": "2026-02-16T08:58:43.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-71221\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:54.450\",\"lastModified\":\"2026-02-18T17:52:22.253\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()\\n\\nAdd proper locking in mmp_pdma_residue() to prevent use-after-free when\\naccessing descriptor list and descriptor contents.\\n\\nThe race occurs when multiple threads call tx_status() while the tasklet\\non another CPU is freeing completed descriptors:\\n\\nCPU 0 CPU 1\\n----- -----\\nmmp_pdma_tx_status()\\nmmp_pdma_residue()\\n -\u003e NO LOCK held\\n list_for_each_entry(sw, ..)\\n DMA interrupt\\n dma_do_tasklet()\\n -\u003e spin_lock(\u0026desc_lock)\\n list_move(sw-\u003enode, ...)\\n spin_unlock(\u0026desc_lock)\\n | dma_pool_free(sw) \u003c- FREED!\\n -\u003e access sw-\u003edesc \u003c- UAF!\\n\\nThis issue can be reproduced when running dmatest on the same channel with\\nmultiple threads (threads_per_chan \u003e 1).\\n\\nFix by protecting the chain_running list iteration and descriptor access\\nwith the chan-\u003edesc_lock spinlock.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndmaengine: mmp_pdma: Correcci\u00f3n de condici\u00f3n de carrera en mmp_pdma_residue()\\n\\nA\u00f1adir bloqueo adecuado en mmp_pdma_residue() para prevenir uso despu\u00e9s de liberaci\u00f3n al acceder a la lista de descriptores y al contenido del descriptor.\\n\\nLa condici\u00f3n de carrera ocurre cuando m\u00faltiples hilos llaman a tx_status() mientras el tasklet en otra CPU est\u00e1 liberando descriptores completados:\\n\\nCPU 0 CPU 1\\n----- -----\\nmmp_pdma_tx_status()\\nmmp_pdma_residue()\\n -\u0026gt; SIN BLOQUEO mantenido\\n list_for_each_entry(sw, ..)\\n Interrupci\u00f3n DMA\\n dma_do_tasklet()\\n -\u0026gt; spin_lock(\u0026amp;desc_lock)\\n list_move(sw-\u0026gt;node, ...)\\n spin_unlock(\u0026amp;desc_lock)\\n | dma_pool_free(sw) \u0026lt;- \u00a1LIBERADO!\\n -\u0026gt; acceso a sw-\u0026gt;desc \u0026lt;- \u00a1UAF!\\n\\nEste problema puede ser reproducido al ejecutar dmatest en el mismo canal con m\u00faltiples hilos (hilos_por_canal \u0026gt; 1).\\n\\nSoluci\u00f3n protegiendo la iteraci\u00f3n de la lista chain_running y el acceso al descriptor con el spinlock chan-\u0026gt;desc_lock.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…