All vulnerabilities
CVE-2026-98344

Linux: dmaengine: Fix device kref underflow in dma_chan_put()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in036b527f92570206da4b8c40b38f8d689e29d0f3Also 5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef, 57f7f1c6827be7d8f80feca48d2125fb91c6f6ed and 4 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 036b527f92570206da4b8c40b38f8d689e29d0f3LinuxCVE List
  • 5fb1797a8c9485e40e5492fa0338ab5c7d1f3fefLinuxCVE List
  • 57f7f1c6827be7d8f80feca48d2125fb91c6f6edLinuxCVE List
  • 7c3f4ce651d43705f9ec7f778f642a90d5ff4fbaLinuxCVE List
  • 1a0d9b406febf23054ad595fd47b29325e70fb2dLinuxCVE List
  • 77906ac448d2fa81fa710ae26c0e591ebdc81154LinuxCVE List
Show all 7 fixed versions
  • 44dab659064eb5c10adb0306510eebe848ed592dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix device kref underflow in dma_chan_put()

dma_chan_get() takes chan->device->ref only on the slow path:

/* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero()

dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference.

The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded.

Fix this by dropping device->ref only on the last put, matching the single slow-path get.

Text from CVE List

Affected versions 18

  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 036b527f92570206da4b8c40b38f8d689e29d0f3CVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 5fb1797a8c9485e40e5492fa0338ab5c7d1f3fefCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 57f7f1c6827be7d8f80feca48d2125fb91c6f6edCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 7c3f4ce651d43705f9ec7f778f642a90d5ff4fbaCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before de2677e57d3161390d8a508f08cddec6ef7e4b23CVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 1a0d9b406febf23054ad595fd47b29325e70fb2dCVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 77906ac448d2fa81fa710ae26c0e591ebdc81154CVE List
  • Linuxaffected: 8ad342a863590b24ce77681b7e081363fb3333f7 before 44dab659064eb5c10adb0306510eebe848ed592dCVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8