CVE-2026-72146 (GCVE-0-2026-72146)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-19 16:36
VLAI
Title
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also lead to issues. Request the interrupts only after everything is set up. To keep the error path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < d24d53323e817d79a4bd111bd10b34dbc96e64a8 (git)
Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < 0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f (git)
Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < 5b12de6229d662864ee22c11d4876652b40120f0 (git)
Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < 2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93 (git)
Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < ec9f66c91bffdb69d309bae6dfb387562db7ebc8 (git)
Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < 07ae600bd353b22f31a8f1007269744fafc7f123 (git)
Affected: 5000d37042a61ca556fde2782ca40dbfa802ea16 , < 731712403ddb39d1a76a11abf339a0615bc85de7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/sh/rz-dmac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d24d53323e817d79a4bd111bd10b34dbc96e64a8",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            },
            {
              "lessThan": "0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            },
            {
              "lessThan": "5b12de6229d662864ee22c11d4876652b40120f0",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            },
            {
              "lessThan": "2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            },
            {
              "lessThan": "ec9f66c91bffdb69d309bae6dfb387562db7ebc8",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            },
            {
              "lessThan": "07ae600bd353b22f31a8f1007269744fafc7f123",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            },
            {
              "lessThan": "731712403ddb39d1a76a11abf339a0615bc85de7",
              "status": "affected",
              "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/sh/rz-dmac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sh: rz-dmac: Move interrupt request after everything is set up\n\nOnce the interrupt is requested, the interrupt handler may run immediately.\nSince the IRQ handler can access channel-\u003ech_base, which is initialized\nonly after requesting the IRQ, this may lead to invalid memory access.\nLikewise, the IRQ thread may access uninitialized data (the ld_free,\nld_queue, and ld_active lists), which may also lead to issues.\n\nRequest the interrupts only after everything is set up. To keep the error\npath simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw triggers in rz_dmac_chan_probe() during Renesas RZ/G2L/V2H/T2H platform DMAC driver initialization at boot or module load; there is no network, Bluetooth, or runtime syscall path to the vulnerable devm_request_threaded_irq() ordering.\nAC:L - Once the DMAC channel IRQ line is asserted when devm_request_threaded_irq() is called after reset_deassert, the hardirq/thread handlers run immediately before ch_base or lists are initialized; stale post-reset interrupt state on these SoCs makes this timing plausible without luck.\nPR:N - rz_dmac_probe() performs no capability or authentication checks before requesting per-channel IRQs; on affected Renesas embedded boards the vulnerable probe sequence runs automatically during kernel boot without the attacker holding Linux privileges.\nUI:N - No victim action is required; pending/latched DMAC channel interrupts during driver probe at boot or reboot can invoke the buggy handlers without anyone opening device nodes or configuring DMA transfers.\nS:U - Impact is kernel NULL dereference, list/spinlock corruption, and MMIO faults within the host kernel; this is not a VM escape, container sandbox breakout, or documented IOMMU security-boundary bypass.\nC:H - The threaded IRQ handler may lock an uninitialized vc.lock and walk uninitialized ld_active/ld_queue/ld_free lists, causing invalid kernel memory reads and list-metadata exposure beyond a pure bounded fault.\nI:H - The hardirq path issues readl/writel through uninitialized ch_base (NULL/low MMIO), and list/spinlock corruption in the IRQ thread can corrupt kernel heap metadata and enable control-flow hijack primitives.\nA:H - Invalid MMIO via NULL ch_base and corrupted IRQ-thread list handling can cause kernel oops/panic during probe on affected embedded systems, causing full loss of availability until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:26.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d24d53323e817d79a4bd111bd10b34dbc96e64a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b12de6229d662864ee22c11d4876652b40120f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec9f66c91bffdb69d309bae6dfb387562db7ebc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/07ae600bd353b22f31a8f1007269744fafc7f123"
        },
        {
          "url": "https://git.kernel.org/stable/c/731712403ddb39d1a76a11abf339a0615bc85de7"
        }
      ],
      "title": "dmaengine: sh: rz-dmac: Move interrupt request after everything is set up",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72146",
    "datePublished": "2026-08-15T05:53:18.431Z",
    "dateReserved": "2026-08-09T03:40:39.908Z",
    "dateUpdated": "2026-08-19T16:36:26.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72146",
      "date": "2026-09-21",
      "epss": "0.0018",
      "percentile": "0.07825"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/sh/rz-dmac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d24d53323e817d79a4bd111bd10b34dbc96e64a8",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b12de6229d662864ee22c11d4876652b40120f0",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ec9f66c91bffdb69d309bae6dfb387562db7ebc8",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "07ae600bd353b22f31a8f1007269744fafc7f123",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "731712403ddb39d1a76a11abf339a0615bc85de7",
                    "status": "affected",
                    "version": "5000d37042a61ca556fde2782ca40dbfa802ea16",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/sh/rz-dmac.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sh: rz-dmac: Move interrupt request after everything is set up\n\nOnce the interrupt is requested, the interrupt handler may run immediately.\nSince the IRQ handler can access channel-\u003ech_base, which is initialized\nonly after requesting the IRQ, this may lead to invalid memory access.\nLikewise, the IRQ thread may access uninitialized data (the ld_free,\nld_queue, and ld_active lists), which may also lead to issues.\n\nRequest the interrupts only after everything is set up. To keep the error\npath simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent()."
          }
        ],
        "id": "CVE-2026-72146",
        "lastModified": "2026-08-19T17:21:00.233",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:32.267",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/07ae600bd353b22f31a8f1007269744fafc7f123"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b12de6229d662864ee22c11d4876652b40120f0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/731712403ddb39d1a76a11abf339a0615bc85de7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d24d53323e817d79a4bd111bd10b34dbc96e64a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ec9f66c91bffdb69d309bae6dfb387562db7ebc8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T13:34:16+00:00",
      "cve": "CVE-2026-72146",
      "id": "CVE-2026-72146",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72146.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:30:10Z",
      "cve": "CVE-2026-72146",
      "id": "CVE-2026-72146",
      "initial_release_date": "2026-08-31T13:30:10Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72146",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72146.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.