CVE-2026-89994

The fsl-edma DMA driver in the Linux kernel stores a raw pointer to its struct fsl_edma_engine in the ftrace ring buffer and dereferences that pointer when a trace log entry is later printed, but by that time the engine structure may already have been freed, causing the log output to touch stale memory. A local user with access to tracefs can force event injection through the fsl_edma tracepoint inject mechanism and then read the trace buffer, making the kernel dereference the dangling pointer. The demonstrated outcome is a kernel crash (denial of service); the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N with C:H/I:H/A:H) reflects a local, low-privilege attack vector, though no privilege-escalation path is described in the fix. Only systems running Linux on NXP/Freescale eDMA hardware (i.MX-class SoCs) with the fsl-edma driver and its trace events enabled are affected. No public PoC beyond the trigger described in the fix is known, the issue is not in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Update to a kernel that includes the upstream dmaengine fsl-edma fix, which appends a membase field to the trace event so log output no longer dereferences the possibly-freed pointer. Until patched, keep tracefs/debugfs mounted only for root or a trusted group (the default root-only access confines the issue to privileged local users), and check whether CONFIG_FSL_EDMA and its tracepoints are enabled in kernels deployed on NXP i.MX hardware.