CVE-2026-89994

A flaw was found in the Linux kernel's dmaengine: fsl-edma component. This vulnerability allows a local attacker to trigger a system crash, leading to a Denial of Service (DoS). The flaw occurs because the fsl edma tracing events store a pointer in a ringbuffer that can become invalid before being dereferenced during log output. An attacker can exploit this by injecting specific events.

The fsl edma trace event stores a pointer to struct fsl_edma_engine in the ring buffer and dereferences it later while formatting the trace output. The referenced engine object may already be freed or otherwise invalid at that time, resulting in a use after free read or a NULL pointer dereference and a kernel crash. Event injection provides a direct local trigger and avoids the need to win a narrow race window. For the CVSS the PR:L in the paranoid score represents systems where tracefs or event injection access is delegated to a restricted service account, container root, or another partially privileged local user. The typical configuration requires administrative tracing privileges and is represented by PR:H in the base score. The issue is not network reachable. Impact is at least local denial of service. Limited confidentiality impact is plausible if stale or reused object data affects the printed offset, but no write primitive or supported privilege escalation path is visible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.