CVE-2025-71221

{"id": "CVE-2025-71221", "cveTags": [], "metrics": {}, "published": "2026-02-14T17:15:54.450", "references": [{"url": "https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()\n\nAdd proper locking in mmp_pdma_residue() to prevent use-after-free when\naccessing descriptor list and descriptor contents.\n\nThe race occurs when multiple threads call tx_status() while the tasklet\non another CPU is freeing completed descriptors:\n\nCPU 0 CPU 1\n----- -----\nmmp_pdma_tx_status()\nmmp_pdma_residue()\n -> NO LOCK held\n list_for_each_entry(sw, ..)\n DMA interrupt\n dma_do_tasklet()\n -> spin_lock(&desc_lock)\n list_move(sw->node, ...)\n spin_unlock(&desc_lock)\n | dma_pool_free(sw) <- FREED!\n -> access sw->desc <- UAF!\n\nThis issue can be reproduced when running dmatest on the same channel with\nmultiple threads (threads_per_chan > 1).\n\nFix by protecting the chain_running list iteration and descriptor access\nwith the chan->desc_lock spinlock."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: mmp_pdma: Correcci\u00f3n de condici\u00f3n de carrera en mmp_pdma_residue()\n\nA\u00f1adir bloqueo adecuado en mmp_pdma_residue() para prevenir uso despu\u00e9s de liberaci\u00f3n al acceder a la lista de descriptores y al contenido del descriptor.\n\nLa condici\u00f3n de carrera ocurre cuando m\u00faltiples hilos llaman a tx_status() mientras el tasklet en otra CPU est\u00e1 liberando descriptores completados:\n\nCPU 0 CPU 1\n----- -----\nmmp_pdma_tx_status()\nmmp_pdma_residue()\n -&gt; SIN BLOQUEO mantenido\n list_for_each_entry(sw, ..)\n Interrupci\u00f3n DMA\n dma_do_tasklet()\n -&gt; spin_lock(&amp;desc_lock)\n list_move(sw-&gt;node, ...)\n spin_unlock(&amp;desc_lock)\n | dma_pool_free(sw) &lt;- \u00a1LIBERADO!\n -&gt; acceso a sw-&gt;desc &lt;- \u00a1UAF!\n\nEste problema puede ser reproducido al ejecutar dmatest en el mismo canal con m\u00faltiples hilos (hilos_por_canal &gt; 1).\n\nSoluci\u00f3n protegiendo la iteraci\u00f3n de la lista chain_running y el acceso al descriptor con el spinlock chan-&gt;desc_lock."}], "lastModified": "2026-02-18T17:52:22.253", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}