In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: Fix race condition in mmppdmaresidue() Add proper locking in mmppdmaresidue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call txstatus() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmppdmatxstatus() mmppdmaresidue() -> NO LOCK held listforeachentry(sw, ..) DMA interrupt dmadotasklet() -> spinlock(&desclock) listmove(sw->node, ...) spinunlock(&desclock) | dmapoolfree(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threadsperchan > 1). Fix by protecting the chainrunning list iteration and descriptor access with the chan->desc_lock spinlock.