{"apiVersion":"1.0","identifier":"CVE-2026-72474","description":"In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 (where this IP is used), DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might remap (and hence vmalloc()) some memory. This became visible in a design where dma_direct_use_pool() is not possible. With the above, when calling dma_free_coherent(), vunmap() would be called from softirq context and thus leading to a BUG(). To fix it, use a dma pool that is allocated in .device_alloc_chan_resources() and allocate blocks from it. The key point is that now dma_pool_free() is used in axi_dmac_free_desc() to free the blocks and that just frees the blocks from the pool in the sense they can be used again. In other words, no actual call to dma_free_coherent() happens. That only happens when destroying the pool in axi_dmac_free_chan_resources() which does not happen in any interrupt context.","publishedAt":"2026-08-15T06:22:21","lastModifiedAt":"2026-08-17T06:19:15","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72474","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00209,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72474","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72474","en":"https://www.redsauce.net/en/cves/CVE-2026-72474","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72474","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72474","de":"https://www.redsauce.net/de/cves/CVE-2026-72474","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72474","el":"https://www.redsauce.net/el/cves/CVE-2026-72474"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72474"}}