{"id":"CVE-2026-98324","published":"2026-10-06T09:18:24.573","lastModified":"2026-10-07T07:17:09.147","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: pxa: fix double counting of the hw descriptors\n\npxad_alloc_desc() was converted from\n\n        kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)\n\nto kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc\nitself - but only where the compiler has __builtin_counted_by_ref(), so\nfrom gcc 15.1 or clang 22.1 on. The loop below it still increments\nnb_desc, which makes it come out doubled there and correct elsewhere.\n\nnb_desc is what pxad_free_desc() iterates over and what\nset_updater_desc() indexes from, so set it explicitly and drop the\nincrement. The error path has to lower it to the number of descriptors\nallocated so far, otherwise pxad_free_desc() would free entries that were\nnever allocated.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/1de93785f32b450e9eae1e4fcfb7d03eb49eb27e","tags":[]},{"url":"https://git.kernel.org/stable/c/f6504be006aa4bb4bd26285f410a885c17920d65","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's PXA DMA engine has a double counting bug where hardware descriptors are counted twice, leading to incorrect memory management and potential data corruption. This occurs when the descriptor allocation function was changed from kzalloc to kzalloc_flex, which introduced a counter conflict that causes the system to allocate more memory than needed.","exploitability":"Exploitation is moderately difficult and requires kernel-level access or a way to trigger specific DMA operations with crafted descriptors, likely involving a local privilege escalation or device driver manipulation.","blast_radius":"If exploited, this vulnerability could lead to system instability, data corruption, or potential privilege escalation in systems using PXA-based DMA controllers, particularly affecting embedded devices and older ARM platforms.","remediation":"Apply the kernel patch that fixes the double counting issue in pxad_alloc_desc() function, specifically addressing the conflict between __counted_by() counter and manual nb_desc increment.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","dma","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:03:10.815Z"}}