CVE-2026-89993: Linux Kernel DMA Engine Buffer Overflow Flaw

CVE-2026-89993 Overview

CVE-2026-89993 is a NULL pointer dereference vulnerability in the Linux kernel's dw-edma DMA engine driver. The flaw resides in the dw_edma_irq_request() function, which passes a struct dw_edma_irq to request_irq() before dw_edma_channel_setup() populates the structure's back pointer. A shared interrupt can enter the handler while dw_irq->dw is still NULL, triggering a kernel NULL pointer dereference. The upstream fix reorders initialization so the back pointer is set before each handler is installed.

Critical Impact
A shared IRQ arriving during driver probe can dereference an uninitialized pointer in the DMA engine interrupt handler, causing a kernel oops and potential system denial of service.

Affected Products

Linux kernel — drivers/dma/dw-edma subsystem
Systems using the Synopsys DesignWare eDMA controller
Multiple stable kernel branches receiving backported fixes (see referenced commits)

Discovery Timeline

2026-09-16 - CVE-2026-89993 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89993

Vulnerability Analysis

The vulnerability affects the Synopsys DesignWare embedded DMA (eDMA) engine driver in the Linux kernel. During driver initialization, dw_edma_irq_request() registers interrupt handlers by calling request_irq() and passes a struct dw_edma_irq object as the handler context. The dw field of that structure, which serves as a back pointer to the parent dw_edma device state, is only populated later during dw_edma_channel_setup().

When the interrupt line is shared with another device, the kernel can invoke the newly registered handler between these two steps. The handler then dereferences dw_irq->dw while it is still NULL, producing a kernel NULL pointer dereference [CWE-476]. The result is a kernel oops on the CPU handling the interrupt.

Root Cause

The root cause is an ordering defect in driver initialization. The IRQ context structure is handed to the kernel's interrupt subsystem before all of its fields are valid. Any shared IRQ delivery in that window enters the handler with incomplete state.

Attack Vector

The defect is triggered by hardware interrupt delivery rather than direct attacker input. Exploitation requires that the eDMA IRQ line be shared and that an interrupt arrive during the probe window. On affected systems this can result in a reproducible crash, meaning any unprivileged workload that induces device activity on a shared IRQ during probing could contribute to a denial-of-service condition. Refer to the upstream kernel commit for the corrected initialization sequence.

Detection Methods for CVE-2026-89993

Indicators of Compromise

Kernel oops messages referencing dw_edma or the DesignWare eDMA IRQ handler in dmesg or serial console output.
NULL pointer dereference backtraces originating from request_irq callbacks during device probe.
Unexpected reboots or hangs on systems using Synopsys DesignWare PCIe controllers with shared interrupts.

Detection Strategies

Inventory running kernels against the fixed commit hashes referenced in the kernel stable tree changes to identify unpatched hosts.
Correlate kernel crash telemetry with driver probe events for the dw-edma module.
Monitor host stability metrics for repeated crashes on hardware platforms that instantiate the DesignWare eDMA driver.

Monitoring Recommendations

Ship kernel logs and crash dumps to a centralized log platform and alert on BUG: or Oops: entries mentioning dw_edma.
Track kernel package versions across the fleet to confirm the patch has been applied.
Review firmware and platform configurations that expose shared interrupt lines to DMA controllers.

How to Mitigate CVE-2026-89993

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix or the corresponding stable backport commits listed in the NVD references.
Reboot affected hosts after applying the patched kernel to load the corrected dw-edma driver.
Prioritize systems that use Synopsys DesignWare PCIe/eDMA hardware and rely on shared IRQ lines.

Patch Information

The fix reorders driver initialization so the back pointer in struct dw_edma_irq is set before request_irq() installs each handler. Patch commits are published in the kernel stable tree, including commit d91fb6c0, commit 07e50cef, commit 17ef6384, commit 647217ab, commit b86280b1, commit d232bc6c, and commit fac202d7.

Workarounds

Where feasible, avoid sharing the eDMA IRQ line with other devices at the platform or firmware level.
Unload the dw-edma module on systems that do not require DMA engine functionality until patched kernels are deployed.
Delay bringing shared-IRQ peripherals online until after the eDMA driver has fully initialized.

bash

# Verify running kernel and dw-edma module status
uname -r
lsmod | grep dw_edma
dmesg | grep -i dw_edma