CVE-2026-72474

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor

For architectures like Microblaze or arm64 (where this IP is used), DMADIRECTREMAP is set which means that dmaalloccoherent() might remap (and hence vmalloc()) some memory. This became visible in a design where dmadirectuse_pool() is not possible.

With the above, when calling dmafreecoherent(), vunmap() would be called from softirq context and thus leading to a BUG().

To fix it, use a dma pool that is allocated in .deviceallocchanresources() and allocate blocks from it. The key point is that now dmapoolfree() is used in axidmacfreedesc() to free the blocks and that just frees the blocks from the pool in the sense they can be used again. In other words, no actual call to dmafreecoherent() happens. That only happens when destroying the pool in axidmacfreechanresources() which does not happen in any interrupt context.