CVE-2026-89994: Linux Kernel fsl-edma Use-After-Free Vulnerability

CVE-2026-89994 Overview

CVE-2026-89994 is a Linux kernel vulnerability in the Freescale enhanced Direct Memory Access (fsl-edma) driver's tracing subsystem. The driver stores a pointer to a struct fsl_edma_engine in the trace ringbuffer and dereferences it when a log entry is later printed. By the time the entry is printed, the pointer may no longer be valid, leading to a stale pointer dereference. A local user with access to the tracing filesystem can trigger the condition through event injection, causing a kernel crash.

Critical Impact
A local, low-privileged user with access to /sys/kernel/tracing can crash the kernel by injecting a crafted fsl_edma trace event, impacting system availability and integrity.

Affected Products

Linux kernel builds including the dmaengine: fsl-edma driver with tracing support
Stable kernel branches prior to the fixes in commits 2a3801ae5c34, 2ea04dca8e62, d382aaf5fed3, and ef02cd3807f3
Platforms using Freescale/NXP eDMA controllers (typically PowerPC and ARM SoCs)

Discovery Timeline

2026-09-16 - CVE-2026-89994 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89994

Vulnerability Analysis

The fsl-edma driver defines trace events for register access operations such as edma_writeb. These events capture a pointer to struct fsl_edma_engine in the trace ringbuffer at record time. The associated print handler dereferences that pointer later, when a userspace consumer reads trace output. Because the ringbuffer entry outlives the guaranteed lifetime of the referenced object, the pointer can point to freed or reused memory. Dereferencing it during log formatting triggers an invalid memory access and a kernel oops.

The upstream fix appends a membase field to the event record and uses that stored value for log output, eliminating the pointer chase. The existing fields are retained for backward compatibility with userspace trace parsers. This vulnerability class falls under kernel Use-After-Free and Null Pointer Dereference conditions in tracepoint handlers.

Root Cause

The root cause is unsafe lifetime management in the fsl_edma tracepoints. Storing a raw kernel pointer in a persistent ringbuffer and dereferencing it during deferred output violates the principle that trace records must be self-contained. When the underlying fsl_edma_engine structure is not guaranteed to remain valid until the buffer is consumed, the dereference is unsafe.

Attack Vector

Exploitation requires local access and permissions on the tracing filesystem, typically mounted at /sys/kernel/tracing. The reproducer from the upstream commit enables the vulnerability using event injection:

cd /sys/kernel/tracing
echo 'value = 0' > events/fsl_edma/edma_writeb/inject
cat trace

Reading the resulting trace output forces the kernel to dereference the stored pointer, producing a crash. No network exposure exists, and no user interaction beyond the tracing operations is required.

Detection Methods for CVE-2026-89994

Indicators of Compromise

Kernel oops or panic messages referencing fsl_edma tracepoint handlers or invalid pointer dereferences originating from trace event printing.
Unexpected writes to /sys/kernel/tracing/events/fsl_edma/*/inject from non-administrative processes.
System reboots or availability incidents on Freescale/NXP eDMA-equipped hardware coinciding with tracing activity.

Detection Strategies

Audit access to the tracing filesystem and alert on write operations to any inject file under events/fsl_edma/.
Collect kernel dmesg and crash dumps and inspect stack traces for frames involving fsl_edma trace print functions.
Correlate crash events with the presence of unpatched kernel versions on affected SoC platforms.

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on repeated oops or general protection fault entries on eDMA-capable hosts.
Track kernel package versions across the fleet to identify systems missing the stable backport commits.
Monitor for unexpected root-equivalent processes interacting with debugfs or tracefs.

How to Mitigate CVE-2026-89994

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 2a3801ae5c34, 2ea04dca8e62, d382aaf5fed3, and ef02cd3807f3.
Restrict access to /sys/kernel/tracing and /sys/kernel/debug/tracing to trusted administrative users only.
Inventory systems using Freescale/NXP eDMA hardware and prioritize them for patching.

Patch Information

The fix modifies the fsl_edma trace event definition to store edma->membase in the record itself, removing the deferred pointer dereference during log output. Patch details are available in the kernel commit 2a3801ae5c34, kernel commit 2ea04dca8e62, kernel commit d382aaf5fed3, and kernel commit ef02cd3807f3.

Workarounds

Unmount or restrict permissions on tracefs where operationally acceptable, blocking write access to trace event inject files.
Disable the fsl_edma trace events at runtime on affected systems until the patch is applied.
Enforce strict role separation so only administrators and trusted diagnostic tooling can interact with the tracing subsystem.

bash

# Restrict tracefs access and disable fsl_edma trace events
chmod 700 /sys/kernel/tracing
echo 0 > /sys/kernel/tracing/events/fsl_edma/enable