CVE-2026-89994 dmaengine: fsl-edma: tracing: no ptr dereference during log output
A null pointer dereference in the fsl-edma tracing driver allows local attackers to crash the system by injecting events into the kernel trace buffer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89994?
CVE-2026-89994 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: fsl-edma: tracing: no ptr dereference during log output
The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid.
Event injection can be used to trigger a crash:
$ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace
The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
Which versions are affected by CVE-2026-89994?
How do I fix CVE-2026-89994?
Apply the vendor's patch.
Is CVE-2026-89994 being exploited?
There is no known exploitation of CVE-2026-89994 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89994, DEBIAN-CVE-2026-89994, GHSA-2hx9-3cqh-fcjj, UBUNTU-CVE-2026-89994.