CVE-2026-98342

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()). Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed. The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list. Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98342

EUVD

EUVD-2026-93327

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2ba05622b8b143b0c95968ba59bddfbd6d2f2559
Linux	Linux	2.6.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's DMA engine subsystem. It involves a race condition where a DMA device can be freed while another part of the kernel is still accessing it. Specifically, dma_issue_pending_all() traverses a list of DMA devices under an RCU read lock, but dma_device_release() can unlink and free a device without waiting for RCU readers to finish. This leads to use-after-free issues as concurrent readers may access freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's dmaengine subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if your kernel version includes the fix. Use commands like 'uname -a' to check kernel version and 'dmesg | grep dma' to look for DMA-related errors.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger the race condition to execute arbitrary code or cause denial-of-service conditions. Systems using DMA-capable devices are at risk, especially those with high I/O workloads where concurrent access is likely.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel memory management issue that could lead to use-after-free errors, potentially causing system instability or crashes. Compliance impacts would only occur if such failures disrupted data processing or security controls.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the fix is included. If immediate patching is not possible, avoid using DMA operations until the update is applied. Monitor kernel logs for any signs of exploitation or instability.

Hi! I’m here to help you understand CVE-2026-98342. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70