CVE-2026-72146

dmaengine: sh: rz-dmac: Move interrupt request after everything is set up

HIGH
8.4
CVSS Score
Published: August 15, 2026 at 05:53 AM UTC
Updated: August 19, 2026 at 05:21 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.4
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also lead to issues. Request the interrupts only after everything is set up. To keep the error path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.15 ≤ v < 5.15.2165.15 ≤ v < 6.1.1835.15 ≤ v < 6.12.1015.15 ≤ v < 6.18.425.15 ≤ v < 6.6.1485.15 ≤ v < 7.1.55.15 ≤ v < 7.25.155000d37042a61ca556fde2782ca40dbfa802ea16
Vendor states this is fixed in 07ae600bd353b22f31a8f1007269744fafc7f123 (fixed)
Vendor states this is fixed in 0e0c5b3cf374ebf3c589741751e1fbc67f53ec2f (fixed)
Vendor states this is fixed in 2a4d9e2234c3f817bb0ddbc8680d09ce9be84f93 (fixed)
Vendor states this is fixed in 5b12de6229d662864ee22c11d4876652b40120f0 (fixed)
Vendor states this is fixed in 731712403ddb39d1a76a11abf339a0615bc85de7 (fixed)
Vendor states this is fixed in d24d53323e817d79a4bd111bd10b34dbc96e64a8 (fixed)
Vendor states this is fixed in ec9f66c91bffdb69d309bae6dfb387562db7ebc8 (fixed)
Vendor states this is fixed in 5.15 (unaffected)
Vendor states this is fixed in 5.15.216 (unaffected)
Vendor states this is fixed in 6.1.183 (unaffected)
Vendor states this is fixed in 6.12.101 (unaffected)
Vendor states this is fixed in 6.18.42 (unaffected)
Vendor states this is fixed in 6.6.148 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

8.4HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card