CVE-2026-72147

A flaw was found in the dw-edma-pcie component of the Linux kernel's Direct Memory Access (DMA) engine. This vulnerability occurs because the dw_edma_pcie_probe() function attempts to use PCI device ID driver data as a template without verifying its presence. A local attacker, by binding a device dynamically through the sysfs interface without the expected driver data, can trigger a NULL pointer dereference. This can lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because triggering the denial of service requires local access to dynamically rebind PCI devices through sysfs, and the issue cannot lead to arbitrary code execution or data exposure. On Red Hat Enterprise Linux, the Synopsys DesignWare PCIe DMA driver is not enabled in standard kernel configurations, preventing exposure on typical installations. Even where the driver is active, exploitation is constrained to a local denial of service via system crash and requires administrative interaction with kernel sysfs interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.