---
id: CVE-2026-93041
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dmaengine: dw-edma: Serialize abort state updates

  dw_edma_abort_interrupt() drops vc.lock before changing request and
  status
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dmaengine: dw-edma: Serialize abort state updates

  dw_edma_abort_interrupt() drops vc.lock before changing request and
  status. issue_pending() can acquire the lock in t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    4a72f81b8681b2ad7705cf039974c443dcc8ff00
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    b7b8b08cd6422f7ed783226ac4aa6cebe398ab54
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    0b028e5175590fb34ccbd537ff5b9cd386ce5747
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    075de95d7a7cd8fecfb6fe1c685c9064fc6c9d76
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    e20c6539394ac8d70240b85bb5963c74a3a49789
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    0c3294066c36d5980fd9c8192dcb53bb9ccd1f7b
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    f71c94c1a657492e015be227d44c4198a8e7a91d
  - >-
    Linux >= e63d79d1ffcd2201a2dbff1d7a1184b8f3ec74cf <
    dd80e259f65d932634e26d366570d71669ef6654
  - Linux 5.3
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:57.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93041'
references:
  - url: 'https://git.kernel.org/stable/c/075de95d7a7cd8fecfb6fe1c685c9064fc6c9d76'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0b028e5175590fb34ccbd537ff5b9cd386ce5747'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0c3294066c36d5980fd9c8192dcb53bb9ccd1f7b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4a72f81b8681b2ad7705cf039974c443dcc8ff00'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b7b8b08cd6422f7ed783226ac4aa6cebe398ab54'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dd80e259f65d932634e26d366570d71669ef6654'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e20c6539394ac8d70240b85bb5963c74a3a49789'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f71c94c1a657492e015be227d44c4198a8e7a91d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.774Z'
epss: 0.00177
epssPercentile: 0.07481
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: dw-edma: Serialize abort state updates

dw_edma_abort_interrupt() drops vc.lock before changing request and
status. issue_pending() can acquire the lock in that small window,
observe the old busy state, and skip starting queued descriptors. Then
the abort handler overwrites the channel status as idle, leaving the new
descriptors stranded for good.

Keep descriptor completion and the state transition in the same critical
section.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.