High 7.8Published Feb 14, 2026

CVE-2025-71221dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()

Updated under an hour ago (Oct 28, 2026, 4:50 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet() -> spin_lock(&desc_lock) list_move(sw->node, ...) spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1). Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1b38da264674d6a0fe26a63996b8f88b88c3da48 before 3f0e0e2d9e752570041e95fd04635e2580097819; from 1b38da264674d6a0fe26a63996b8f88b88c3da48 before dfb5e05227745de43b7fd589721817a4337c970d; from 1b38da264674d6a0fe26a63996b8f88b88c3da48 before eba0c75670c022cb1f948600db972524bcfe8166; from 1b38da264674d6a0fe26a63996b8f88b88c3da48 before fc023b8fab057f0c910856ff36d3e12a30b7af4a; from 1b38da264674d6a0fe26a63996b8f88b88c3da48 before 9f665b3c3d9a168410251f27a5d019b7bf93185c; from 1b38da264674d6a0fe26a63996b8f88b88c3da48 before a143545855bc2c6e1330f6f57ae375ac44af00a7	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.16 before 6.18.10; 6.19; 6.19; 6.19; 6.19; 6.19	NVD

References

References

https://git.kernel.org/stable/c/3f0e0e2d9e752570041e95fd04635e2580097819
https://git.kernel.org/stable/c/dfb5e05227745de43b7fd589721817a4337c970d
https://git.kernel.org/stable/c/eba0c75670c022cb1f948600db972524bcfe8166
https://git.kernel.org/stable/c/fc023b8fab057f0c910856ff36d3e12a30b7af4a
https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c	patch
https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.