All vulnerabilities
CVE-2026-98343

Linux: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in855187a88bdf762c46b6849307597e3e02bfc1d9Also 07eb075b60d565a5e465a1945a80cc62807492ad, 9319dd64d5cdef851841c091f30424faa2284c31 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 855187a88bdf762c46b6849307597e3e02bfc1d9LinuxCVE List
  • 07eb075b60d565a5e465a1945a80cc62807492adLinuxCVE List
  • 9319dd64d5cdef851841c091f30424faa2284c31LinuxCVE List
  • 6cf31716b77a71c0d634106f4f3951377b8dc6dcLinuxCVE List
  • 02bd02c585293634b213b142cba63cbf77891f6bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels.

dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device.

Text from CVE List

Affected versions 18

  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before b92c502595336a3cc5bb7a060170891366745a5dCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 855187a88bdf762c46b6849307597e3e02bfc1d9CVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before c9780b601438137494b407eb4301bb3de2587ac9CVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 07eb075b60d565a5e465a1945a80cc62807492adCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 9319dd64d5cdef851841c091f30424faa2284c31CVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 6cf31716b77a71c0d634106f4f3951377b8dc6dcCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 02bd02c585293634b213b142cba63cbf77891f6bCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before e873c74132f0c5f1452816cd9bb26208f0bba1e1CVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8