CVE-2026-72147dmaengine: dw-edma-pcie: Reject devices without driver data
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dw_edma_pcie_probe() treats the PCI device ID driver_data as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can match the driver without that data, which leads to a NULL pointer dereference. Reject such matches before enabling the device.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 41aaff2a2ac01c5f5415f9de9cd7015ac2b8d569 before 2733b5dcb5a4ba4446f7bac954b97e4501dcaa64; from 41aaff2a2ac01c5f5415f9de9cd7015ac2b8d569 before a1042599fa8f9e313be176eb1ea1ae199f983419; from 41aaff2a2ac01c5f5415f9de9cd7015ac2b8d569 before 043acb00e4edd4b9ffb9dd0e357482dcd9086486; from 41aaff2a2ac01c5f5415f9de9cd7015ac2b8d569 before 044f7b3252d4fb2143d4999eec2800c08f1001ed; 41aaff2a2ac01c5f5415f9de9cd7015ac2b8d569 builds before 11d7cfe0c119691b2dafbb699bbca90258c678aa | CNA record |
References
- https://git.kernel.org/stable/c/2733b5dcb5a4ba4446f7bac954b97e4501dcaa64
- https://git.kernel.org/stable/c/a1042599fa8f9e313be176eb1ea1ae199f983419
- https://git.kernel.org/stable/c/043acb00e4edd4b9ffb9dd0e357482dcd9086486
- https://git.kernel.org/stable/c/044f7b3252d4fb2143d4999eec2800c08f1001ed
- https://git.kernel.org/stable/c/11d7cfe0c119691b2dafbb699bbca90258c678aa
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.