CVE-2026-98344dmaengine: Fix device kref underflow in dma_chan_put()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes chan->device->ref only on the slow path: /* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero() dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference. The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded. Fix this by dropping device->ref only on the last put, matching the single slow-path get.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8ad342a863590b24ce77681b7e081363fb3333f7 before 036b527f92570206da4b8c40b38f8d689e29d0f3; 8ad342a863590b24ce77681b7e081363fb3333f7 builds before 5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef; from 8ad342a863590b24ce77681b7e081363fb3333f7 before 57f7f1c6827be7d8f80feca48d2125fb91c6f6ed; 8ad342a863590b24ce77681b7e081363fb3333f7 builds before 7c3f4ce651d43705f9ec7f778f642a90d5ff4fba; from 8ad342a863590b24ce77681b7e081363fb3333f7 before de2677e57d3161390d8a508f08cddec6ef7e4b23; 8ad342a863590b24ce77681b7e081363fb3333f7 builds before 1a0d9b406febf23054ad595fd47b29325e70fb2d; from 8ad342a863590b24ce77681b7e081363fb3333f7 before 77906ac448d2fa81fa710ae26c0e591ebdc81154; from 8ad342a863590b24ce77681b7e081363fb3333f7 before 44dab659064eb5c10adb0306510eebe848ed592d | CNA record |
References
- https://git.kernel.org/stable/c/036b527f92570206da4b8c40b38f8d689e29d0f3
- https://git.kernel.org/stable/c/5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef
- https://git.kernel.org/stable/c/57f7f1c6827be7d8f80feca48d2125fb91c6f6ed
- https://git.kernel.org/stable/c/7c3f4ce651d43705f9ec7f778f642a90d5ff4fba
- https://git.kernel.org/stable/c/de2677e57d3161390d8a508f08cddec6ef7e4b23
- https://git.kernel.org/stable/c/1a0d9b406febf23054ad595fd47b29325e70fb2d
- https://git.kernel.org/stable/c/77906ac448d2fa81fa710ae26c0e591ebdc81154
- https://git.kernel.org/stable/c/44dab659064eb5c10adb0306510eebe848ed592d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.