CVE-2026-98324

Summary

The Linux kernel's PXA DMA engine has a double counting bug where hardware descriptors are counted twice, leading to incorrect memory management and potential data corruption. This occurs when the descriptor allocation function was changed from kzalloc to kzalloc_flex, which introduced a counter conflict that causes the system to allocate more memory than needed.

Exploitability

Exploitation is moderately difficult and requires kernel-level access or a way to trigger specific DMA operations with crafted descriptors, likely involving a local privilege escalation or device driver manipulation.

Blast radius

If exploited, this vulnerability could lead to system instability, data corruption, or potential privilege escalation in systems using PXA-based DMA controllers, particularly affecting embedded devices and older ARM platforms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the kernel patch that fixes the double counting issue in pxad_alloc_desc() function, specifically addressing the conflict between __counted_by() counter and manual nb_desc increment.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.