CVE-2026-98344
Received Received - Intake

Reference Leak in Linux Kernel DMA Engine

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes chan->device->ref only on the slow path: /* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero() dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference. The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded. Fix this by dropping device->ref only on the last put, matching the single slow-path get.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98344
EUVD
EUVD-2026-93329

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 8ad342a863590b24ce77681b7e081363fb3333f7
Linux Linux 5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference count underflow in the DMA engine subsystem. The issue occurs when dma_chan_get() and dma_chan_put() functions improperly manage device references. Specifically, dma_chan_put() drops a device reference unconditionally, even when dma_chan_get() only took the reference on the slow path. This causes the reference count to underflow, leading to potential module unloading issues.

Impact Analysis

This vulnerability could cause the DMA engine to malfunction or crash if the reference count underflow leads to incorrect module unloading. Users might experience system instability, data corruption, or unexpected behavior in applications relying on DMA operations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the dmaengine reference underflow issue. Monitor kernel logs for dmaengine-related errors or crashes that may indicate exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart