All vulnerabilities
CVE-2026-98342

Linux: dmaengine: wait for RCU readers before releasing dma_device

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14578c78405d51fa92e4ada4502a45f537c0fcb8Also 8577a5ec4f7e00443015ef99f646def093121a1b, 4448a539a0c39141cccc67be6cacde0f35024313 and 1 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 14578c78405d51fa92e4ada4502a45f537c0fcb8LinuxCVE List
  • 8577a5ec4f7e00443015ef99f646def093121a1bLinuxCVE List
  • 4448a539a0c39141cccc67be6cacde0f35024313LinuxCVE List
  • 4aed7e47a10b94ea3c5171e8d1382081accd2e03LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: wait for RCU readers before releasing dma_device

dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()).

Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed.

The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list.

Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.

Text from CVE List

Affected versions 18

  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before ac8ce9f89638d6d79875cca7d8ae42566a9bde15CVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before 14578c78405d51fa92e4ada4502a45f537c0fcb8CVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before cbb3310a5167e868a5e763e32b9a23b4d50669eeCVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before 8577a5ec4f7e00443015ef99f646def093121a1bCVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before 4448a539a0c39141cccc67be6cacde0f35024313CVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77CVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before 4aed7e47a10b94ea3c5171e8d1382081accd2e03CVE List
  • Linuxaffected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 before dc750422170a563c7a81f6e49d36bb02c62ae37fCVE List
  • Linuxaffected: 2.6.29CVE List
  • Linuxunaffected: all versions before 2.6.29CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8