In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

slab-use-after-free in dma_chan_put+0x3e6/0x4c0
Read of size 8 by task insmod/6319
Freed by task 6319:
kfree+0x225/0x470
dma_chan_put+0x395/0x4c0
dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/02bd02c585293634b213b142cba63cbf77891f6b cve-icon cve-icon
https://git.kernel.org/stable/c/07eb075b60d565a5e465a1945a80cc62807492ad cve-icon cve-icon
https://git.kernel.org/stable/c/6cf31716b77a71c0d634106f4f3951377b8dc6dc cve-icon cve-icon
https://git.kernel.org/stable/c/855187a88bdf762c46b6849307597e3e02bfc1d9 cve-icon cve-icon
https://git.kernel.org/stable/c/9319dd64d5cdef851841c091f30424faa2284c31 cve-icon cve-icon
https://git.kernel.org/stable/c/b92c502595336a3cc5bb7a060170891366745a5d cve-icon cve-icon
https://git.kernel.org/stable/c/c9780b601438137494b407eb4301bb3de2587ac9 cve-icon cve-icon
https://git.kernel.org/stable/c/e873c74132f0c5f1452816cd9bb26208f0bba1e1 cve-icon cve-icon
History

Tue, 06 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device.
Title dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-06T08:46:33.196Z

Reserved: 2026-09-25T10:25:14.343Z

Link: CVE-2026-98343

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:27.163

Modified: 2026-10-06T09:18:27.163

Link: CVE-2026-98343

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T13:45:18Z

Weaknesses