CVE-2026-80902 Overview
CVE-2026-80902 is a memory leak vulnerability in the Linux kernel's sun6i-dma DMA engine driver. The flaw resides in the descriptor reclamation logic invoked when Direct Memory Access (DMA) transfers are terminated. The driver only reclaimed cyclic descriptors, leaving non-cyclic descriptors and their Linked List Item (LLI) chains permanently leaked in kernel memory. The fix migrates the driver to vchan_terminate_vdesc(), which correctly handles both descriptor classes by queuing them on the desc_terminated list for cleanup. An additional pchan->desc != pchan->done check prevents double-adding completed descriptors, which would corrupt the internal list.
Critical Impact
Repeated DMA termination on Allwinner sun6i-based systems leaks kernel memory and can corrupt internal descriptor lists, degrading stability over time.
Affected Products
- Linux kernel sun6i-dma dmaengine driver (Allwinner sun6i/A31 and derivatives)
- Stable kernel branches referenced in the eight upstream fix commits
- Embedded and single-board computer platforms using Allwinner SoCs with the sun6i DMA controller
Discovery Timeline
- 2026-09-04 - CVE-2026-80902 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80902
Vulnerability Analysis
The sun6i-dma driver manages DMA transfers on Allwinner sun6i-family System-on-Chips (SoCs). When a client terminates a transfer, the driver must reclaim any in-flight virtual descriptors (vdesc) and their associated LLI chains. The pre-patch termination path only accounted for cyclic descriptors. Non-cyclic descriptors, which back most one-shot memory-to-memory and peripheral transfers, were never returned to the descriptor pool. Each termination therefore leaked one descriptor plus every LLI it referenced, exhausting kernel memory over time.
Root Cause
The root cause is incomplete cleanup logic in the driver's terminate callback. The code branched on descriptor type and released cyclic descriptors while silently dropping non-cyclic ones. The generic virtual DMA channel helper vchan_terminate_vdesc() already provides correct handling for both cases by appending descriptors to the per-channel desc_terminated queue. The driver bypassed this helper, producing the leak. This is categorized as a Memory Leak with a secondary risk of list corruption.
Attack Vector
The attack vector is local. Any workload that repeatedly starts and terminates DMA operations, such as audio, SPI, or camera drivers on affected hardware, will trigger the leak during normal operation. A local user with access to a device node that issues DMA transfers can amplify the leak by looping start-and-abort sequences, eventually inducing Out-Of-Memory (OOM) conditions or list corruption on the DMA channel. The upstream patch adds the pchan->desc != pchan->done guard to block double-insertion of an already-completed descriptor, which would otherwise corrupt the desc_terminated list.
No public exploit code is available. Technical details are documented in the upstream commits, including Kernel Patch 004a7a0, Kernel Patch 1ccc5c0, and Kernel Patch bb87440.
Detection Methods for CVE-2026-80902
Indicators of Compromise
- Steady, unexplained growth in Slab and KernelStack values reported by /proc/meminfo on Allwinner sun6i systems.
- OOM killer invocations correlated with heavy DMA-driven workloads such as audio streaming or SPI transfers.
- Kernel log warnings referencing sun6i-dma channel state or list corruption around termination events.
Detection Strategies
- Audit the running kernel version against the fixed commits listed in the NVD references to confirm the patch is applied.
- Instrument long-running embedded workloads with periodic slab accounting snapshots to catch monotonically increasing DMA descriptor allocations.
- Correlate DMA client driver termination call rates with kernel memory pressure metrics.
Monitoring Recommendations
- Ship kernel logs, /proc/meminfo, and slabtop output to a centralized telemetry pipeline for trend analysis on fleets of Allwinner-based devices.
- Alert on sustained slab growth or OOM events on systems that historically maintain stable memory baselines.
- Track termination call counters exposed via debugfs for the DMA engine to detect abusive local workloads.
How to Mitigate CVE-2026-80902
Immediate Actions Required
- Update affected Linux kernels to a stable release containing one of the fix commits referenced in the NVD entry.
- Inventory Allwinner sun6i-based devices in the fleet and prioritize those running long-lived DMA workloads for patching.
- Restrict local access on affected devices to trusted users until the patched kernel is deployed.
Patch Information
The fix replaces the custom cyclic-only reclaim path with vchan_terminate_vdesc() and adds a pchan->desc != pchan->done guard. Backports are available across multiple stable branches, including Kernel Patch 27806fe, Kernel Patch 9086b48, Kernel Patch ab11501, Kernel Patch b150f60, and Kernel Patch d4ba6aa.
Workarounds
- Reboot affected devices on a scheduled cadence to reclaim leaked kernel memory until patches can be applied.
- Disable or reduce optional peripherals that generate high-frequency DMA start/terminate cycles where operationally acceptable.
- Constrain local user access to DMA-backed device nodes to minimize amplification of the leak.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
