dmaengine: wait for RCU readers before releasing dma_device

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98342
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-06 09:18:27 UTC
Updated2026-10-06 09:18:27 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()). Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed. The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list. Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.

Risk And Classification

EPSS: 0.001840000 probability, percentile 0.072980000 (date 2026-10-06)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 ac8ce9f89638d6d79875cca7d8ae42566a9bde15 git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 14578c78405d51fa92e4ada4502a45f537c0fcb8 git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 cbb3310a5167e868a5e763e32b9a23b4d50669ee git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 8577a5ec4f7e00443015ef99f646def093121a1b git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 4448a539a0c39141cccc67be6cacde0f35024313 git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77 git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 4aed7e47a10b94ea3c5171e8d1382081accd2e03 git Not specified
CNA Linux Linux affected 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 dc750422170a563c7a81f6e49d36bb02c62ae37f git Not specified
CNA Linux Linux affected 2.6.29 Not specified
CNA Linux Linux unaffected 2.6.29 semver Not specified
CNA Linux Linux unaffected 5.10.271 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.54 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.8 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc4 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report