CVE-2026-98342 (GCVE-0-2026-98342)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
Title
dmaengine: wait for RCU readers before releasing dma_device
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()). Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed. The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list. Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < ac8ce9f89638d6d79875cca7d8ae42566a9bde15 (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < 14578c78405d51fa92e4ada4502a45f537c0fcb8 (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < cbb3310a5167e868a5e763e32b9a23b4d50669ee (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < 8577a5ec4f7e00443015ef99f646def093121a1b (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < 4448a539a0c39141cccc67be6cacde0f35024313 (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77 (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < 4aed7e47a10b94ea3c5171e8d1382081accd2e03 (git)
Affected: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 , < dc750422170a563c7a81f6e49d36bb02c62ae37f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.10.271 , ≤ 5.10.* (semver)
Unaffected: 5.15.222 , ≤ 5.15.* (semver)
Unaffected: 6.1.189 , ≤ 6.1.* (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dmaengine.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ac8ce9f89638d6d79875cca7d8ae42566a9bde15",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "14578c78405d51fa92e4ada4502a45f537c0fcb8",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "cbb3310a5167e868a5e763e32b9a23b4d50669ee",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "8577a5ec4f7e00443015ef99f646def093121a1b",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "4448a539a0c39141cccc67be6cacde0f35024313",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "4aed7e47a10b94ea3c5171e8d1382081accd2e03",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            },
            {
              "lessThan": "dc750422170a563c7a81f6e49d36bb02c62ae37f",
              "status": "affected",
              "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dmaengine.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: wait for RCU readers before releasing dma_device\n\ndma_issue_pending_all() walks the dma_device_list with\nlist_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()\nunlinks the device with list_del_rcu() and then calls\ndevice-\u003edevice_release() (which in many drivers, such as plx_dma.c,\ndirectly calls kfree()).\n\nBecause there is no grace period between unlinking the device and\nfreeing it, concurrent RCU readers in dma_issue_pending_all() can\naccess the device after it has been freed.\n\nThe lockless walk originally relied on clients holding a dmaengine\nreference to pin the provider module, and therefore the device, for as\nlong as they might traverse the list. Commit 8ad342a86359 (\"dmaengine:\nAdd reference counting to dma_device struct\") decoupled the dma_device\nlifetime from the module reference, so the device can now be released\nwhile a reader is still walking the list.\n\nAdd synchronize_rcu() before the device is freed, so RCU readers are\nguaranteed to have finished. Keep it unconditional: providers that do\nnot implement device_release() free the device themselves once\ndma_async_device_unregister() returns. This call will delay for a grace\nperiod with dma_list_mutex held, which is safe and only teardown path is\ndelayed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T08:46:32.366Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15"
        },
        {
          "url": "https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f"
        }
      ],
      "title": "dmaengine: wait for RCU readers before releasing dma_device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98342",
    "datePublished": "2026-10-06T08:46:32.366Z",
    "dateReserved": "2026-09-25T10:25:14.342Z",
    "dateUpdated": "2026-10-06T08:46:32.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98342",
      "date": "2026-10-06",
      "epss": "0.00184",
      "percentile": "0.07298"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/dmaengine.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ac8ce9f89638d6d79875cca7d8ae42566a9bde15",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14578c78405d51fa92e4ada4502a45f537c0fcb8",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cbb3310a5167e868a5e763e32b9a23b4d50669ee",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8577a5ec4f7e00443015ef99f646def093121a1b",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4448a539a0c39141cccc67be6cacde0f35024313",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4aed7e47a10b94ea3c5171e8d1382081accd2e03",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc750422170a563c7a81f6e49d36bb02c62ae37f",
                    "status": "affected",
                    "version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/dmaengine.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.29"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: wait for RCU readers before releasing dma_device\n\ndma_issue_pending_all() walks the dma_device_list with\nlist_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()\nunlinks the device with list_del_rcu() and then calls\ndevice-\u003edevice_release() (which in many drivers, such as plx_dma.c,\ndirectly calls kfree()).\n\nBecause there is no grace period between unlinking the device and\nfreeing it, concurrent RCU readers in dma_issue_pending_all() can\naccess the device after it has been freed.\n\nThe lockless walk originally relied on clients holding a dmaengine\nreference to pin the provider module, and therefore the device, for as\nlong as they might traverse the list. Commit 8ad342a86359 (\"dmaengine:\nAdd reference counting to dma_device struct\") decoupled the dma_device\nlifetime from the module reference, so the device can now be released\nwhile a reader is still walking the list.\n\nAdd synchronize_rcu() before the device is freed, so RCU readers are\nguaranteed to have finished. Keep it unconditional: providers that do\nnot implement device_release() free the device themselves once\ndma_async_device_unregister() returns. This call will delay for a grace\nperiod with dma_list_mutex held, which is safe and only teardown path is\ndelayed."
          }
        ],
        "id": "CVE-2026-98342",
        "lastModified": "2026-10-06T09:18:27.003",
        "metrics": {},
        "published": "2026-10-06T09:18:27.003",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.