CVE-2026-72474

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor

For architectures like Microblaze or arm64 (where this IP is used),

DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might

remap (and hence vmalloc()) some memory. This became visible in a design

where dma_direct_use_pool() is not possible.

With the above, when calling dma_free_coherent(), vunmap() would be

called from softirq context and thus leading to a BUG().

To fix it, use a dma pool that is allocated in

.device_alloc_chan_resources() and allocate blocks from it. The key

point is that now dma_pool_free() is used in axi_dmac_free_desc() to

free the blocks and that just frees the blocks from the pool in the

sense they can be used again. In other words, no actual call to

dma_free_coherent() happens. That only happens when destroying the pool

in axi_dmac_free_chan_resources() which does not happen in any interrupt

context.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References