SB2026100723 - Use-after-free in Linux kernel dma driver
Published: October 7, 2026
Security Bulletin ID
SB2026100723
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Use-after-free (CVE-ID: CVE-2026-98342)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free.
The vulnerability exists due to use-after-free in the Linux kernel DMA engine when releasing a DMA device while concurrent RCU readers traverse the device list. A local user can trigger concurrent device release and list traversal to trigger a use-after-free.
Holding a dmaengine reference to the provider module no longer guarantees that the DMA device remains alive.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8
- https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313
- https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03
- https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b
- https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15
- https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee
- https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f
- https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77