Use-after-free in Linux kernel - CVE-2026-98342
Published: October 7, 2026
Vulnerability identifier: #VU153678
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98342
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger a use-after-free.
The vulnerability exists due to use-after-free in the Linux kernel DMA engine when releasing a DMA device while concurrent RCU readers traverse the device list. A local user can trigger concurrent device release and list traversal to trigger a use-after-free.
Holding a dmaengine reference to the provider module no longer guarantees that the DMA device remains alive.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98342
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8
- https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313
- https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03
- https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b
- https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15
- https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee
- https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f
- https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77