CVE-2026-93169
kernel: dmaengine: zynqmp_dma: fix race between runtime PM and device removal
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's dmaengine: zynqmp_dma component. A race condition exists during device removal, specifically in the zynqmp_dma_remove() function, where runtime power management (PM) is disabled after checking the device state and performing a manual suspend. This timing issue can lead to unexpected behavior or system instability when a device is being removed or unbound, as it races with normal runtime PM operations.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition