CVE-2026-98243
Received Received - Intake

NULL Pointer Dereference in Linux Kernel DMA-BUF

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avoid a potential NULL dereference when the ops pointer has been cleared. The problem is now that the ops pointer is cleared only when neither the release nor the wait callback is implemented and this isn't true for a lot of dma_fence implementations yet. So those implementations lost the RCU protection after signaling of the returned string resulting in potential use after free. Add the signaling check additional to the ops pointer check so that we have both the protection against NULL dereference as well as the RCU protection after signaling for the returned string. v2: improve comments to note RCU protection and explain why we check both signaling state and ops pointer v3: some comment improvements suggested by Philip

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98243
EUVD
EUVD-2026-93171

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 035219a760edb35ae9a9e96beba7f122e26a997b
Linux Linux 035219a760edb35ae9a9e96beba7f122e26a997b
Linux Linux 15ecfdf0ef6f6d874d0a26690d300857b39ebfd0
Linux Linux 7.1.5
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the dma-buf/dma-fence subsystem where a NULL pointer dereference check was changed to test the ops pointer instead of the signaled bit. This change inadvertently removed RCU protection for many dma_fence implementations after signaling, leading to potential use-after-free issues when the ops pointer is cleared.

Detection Guidance

This vulnerability is specific to the Linux kernel's dma-buf/dma-fence subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if your kernel version includes the patched code. Commands like 'dmesg | grep -i fence' or 'uname -r' may help identify affected systems.

Impact Analysis

This vulnerability could allow an attacker to trigger a use-after-free condition in the Linux kernel, potentially leading to system crashes, privilege escalation, or arbitrary code execution. Systems relying on dma-buf/dma-fence for memory management may be affected.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the patched code is installed. If updates are unavailable, consider disabling affected dma-buf features temporarily or consult your vendor for a patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart