CVE-2024-26790: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26790 is a vulnerability in the Linux kernel's DMA engine, specifically affecting the Freescale QDMA controller driver. The vulnerability was discovered and disclosed on April 4, 2024. It affects Linux kernel versions from 5.1 through 6.7.9, including various distribution-specific kernels (NVD).

The vulnerability occurs when unaligned read transactions initiated by QDMA may stall in the NOC (Network On-Chip) of the ls1028a chip, causing a deadlock condition. These stalled transactions trigger completion timeouts in the PCIe controller. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a system deadlock, leading to a denial of service condition in affected systems. The impact is primarily on system availability, with no direct effect on confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. It specifically affects systems using the Freescale QDMA controller with unaligned read transactions on the ls1028a chip (NVD).

A workaround has been implemented by enabling prefetch through setting the source descriptor prefetchable bit (SD[PF] = 1). The fix has been incorporated into various kernel versions, and multiple Linux distributions have released patches. Ubuntu has released fixes for affected versions, including 5.15.0-1063.69 for 22.04 LTS and 5.4.0-1126.136 for 20.04 LTS (Ubuntu).