CVE-2026-72149

HighCVSS 7.5/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: tegra: Fix burst size calculation

Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length is not evenly divisible by the configured max burst size, the DMA hangs with partial burst at the end.

Fix this by reducing the burst size to the largest power-of-2 value that evenly divides the transfer length. For example, a 40-byte transfer with a 16-byte max burst will now use an 8-byte burst (40 / 8 = 5 complete bursts) instead of causing a hang.

This issue was observed with the PL011 UART driver where TX DMA transfers of arbitrary lengths were stuck.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ee17028009d49fffed8cc963455d33b1fd3f1d08, < 735951baa311c66353405dcac39375dd66441db0; >= ee17028009d49fffed8cc963455d33b1fd3f1d08, < 8f0f5de1091119679d87f60dfb1acbff4b2a0ed3; >= ee17028009d49fffed8cc963455d33b1fd3f1d08, < a3b76b54e06d73166af4d1a284a0e0711889060c; >= ee17028009d49fffed8cc963455d33b1fd3f1d08, < 7926c1e4be86379945fb5f168888ac4d2aaf6c91; >= ee17028009d49fffed8cc963455d33b1fd3f1d08, < 6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1; >= ee17028009d49fffed8cc963455d33b1fd3f1d08, < 4651df83b6c796daead3447e8fd874322918ee4f
LinuxLinux5.19

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72157.3A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_seCVE-2026-72150In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprt_create_args structure The xprt_create_aCVE-2026-721518.4In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salCVE-2026-72152In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() wait_event_iCVE-2026-72153In the Linux kernel, the following vulnerability has been resolved: irqchip/crossbar: Use correct index in crossbar_domain_free() crossbarCVE-2026-721547.8In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jump_label smp syncing The original commit 8c30b0018f9d CVE-2026-72155In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the CVE-2026-72156In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_heaCVE-2026-721578.8In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_pCVE-2026-72158In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh_get_param_size() dfh_get_param_sizeCVE-2026-72159In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject non-inline dinodes with i_size and zero i_clusters On a CVE-2026-72167.3A weakness has been identified in donchelo processing-claude-mcp-bridge up to e017b20a4b592a45531a6392f494007f04e661bd. Impacted is an unkno
CVE-2026-72149: High severity, CVSS 7.5 | Vulnix