CVE-2026-46255: Linux fsl-edma Clock Resource Management Bug

Technical summary

CVE-2026-46255 is a resource lifecycle management vulnerability in the Linux kernel's Freescale/NXP eDMA controller driver (fsl-edma). The driver allocates clock resources using devm_clk_get_enabled(), which automatically manages resource cleanup through the device manager framework. However, the fsl_edma_remove() function explicitly calls fsl_disable_clocks(), attempting to manually disable these same clocks. This creates a double-disable condition: the kernel's device manager calls clk_core_disable() and clk_core_unprepare() as part of automatic cleanup, then the driver's remove handler calls these functions again. The Linux clock framework tracks prepare/enable counts and warns when these counters go negative, surfacing the bug via kernel warnings on module unload.

Business impact

This vulnerability primarily affects system stability during driver lifecycle operations on platforms using the Freescale eDMA controller. While not a traditional security issue, the kernel warnings indicate improper resource management that could lead to unpredictable behavior, failed driver reloads, or system hangs in embedded or automotive systems where eDMA is critical for device I/O. For organizations running Linux on NXP/Freescale hardware (common in networking equipment, automotive ECUs, and IoT devices), this bug complicates driver updates and hot-reload scenarios, increasing operational risk during maintenance windows.

Affected systems

The vulnerability affects the Linux kernel's fsl-edma driver, which is the Direct Memory Access (DMA) controller driver for Freescale/NXP eDMA hardware. This includes systems using NXP/Freescale SoCs in automotive, industrial, networking, and embedded IoT applications. The affected component is architecturally specific to ARM and PowerPC platforms that integrate Freescale eDMA IP blocks. Kernel versions using the vulnerable driver code path are in scope; organizations should verify their kernel version against vendor advisories for exact affected releases.

Exploitability

This is not an exploitable security vulnerability in the traditional sense. It is a kernel code defect that generates warnings and indicates improper resource management. An attacker cannot remotely trigger the issue or gain unauthorized access; the condition manifests only during driver removal (module unload or system shutdown). Local privilege is not required to trigger the warnings—any process can remove the driver if the driver supports dynamic unload. The practical impact is degraded system behavior and diagnostic noise rather than a confidentiality, integrity, or availability breach.

Remediation

The fix requires removing the explicit fsl_disable_clocks() call from the fsl_edma_remove() function, allowing the devm_ resource manager to handle clock cleanup automatically. This aligns driver code with the device manager pattern used during allocation. Verify against the Linux kernel upstream commit and your distribution's backport to confirm the exact patch applied. Organizations running affected kernel versions should schedule updates during regular maintenance cycles, prioritizing systems where eDMA driver reloads are frequent or where kernel warning spam impacts monitoring systems.

Patch guidance

Apply the Linux kernel patch that removes the redundant clock disable logic from fsl_edma_remove(). Check your Linux distribution's advisory for backported versions targeting stable branches (e.g., linux-stable, vendor-specific LTS kernels). Test driver reloads (modprobe -r fsl_edma && modprobe fsl_edma) to verify kernel warnings no longer appear in system logs. Confirm no functional regression by validating DMA operations on affected hardware during the testing window before production deployment.

Detection guidance

Monitor kernel logs for the specific warnings: 'edma_module already disabled' and 'edma_module already unprepared' paired with clk_core_disable() and clk_core_unprepare() call traces during fsl_edma removal. These warnings indicate the vulnerable code path is executing. Implement log aggregation rules to flag these patterns on systems running affected kernel versions. Additionally, inspect kernel sources or use kconfig/modinfo to confirm fsl-edma driver presence and version on target systems.

Why prioritize this

Prioritize patching systems where eDMA driver reloads are operational necessity (e.g., firmware update procedures, container workloads with driver module cycling) or where kernel warning suppression is difficult due to monitoring constraints. Systems with stable uptimes and no foreseen driver reload cycles may deprioritize this patch. The CVSS 5.5 MEDIUM score reflects the availability impact of improper driver removal; patching should align with regular kernel update cycles rather than emergency response.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) is assigned for a local attack vector, low complexity, requiring local privilege to trigger, with no confidentiality or integrity impact but high availability impact. The score reflects that driver removal failures or resource leaks can degrade system stability and prevent legitimate driver operations (availability = high). However, the attack vector is local-only and requires explicit driver unload action, preventing remote exploitation.

Frequently asked questions