GHSA-JVJW-JPR2-5GJP
Vulnerability from github – Published: 2026-10-06 09:31 – Updated: 2026-10-06 09:31In the Linux kernel, the following vulnerability has been resolved:
dmaengine: wait for RCU readers before releasing dma_device
dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()).
Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed.
The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list.
Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.
{
"affected": [],
"aliases": [
"CVE-2026-98342"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T09:18:27Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: wait for RCU readers before releasing dma_device\n\ndma_issue_pending_all() walks the dma_device_list with\nlist_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()\nunlinks the device with list_del_rcu() and then calls\ndevice-\u003edevice_release() (which in many drivers, such as plx_dma.c,\ndirectly calls kfree()).\n\nBecause there is no grace period between unlinking the device and\nfreeing it, concurrent RCU readers in dma_issue_pending_all() can\naccess the device after it has been freed.\n\nThe lockless walk originally relied on clients holding a dmaengine\nreference to pin the provider module, and therefore the device, for as\nlong as they might traverse the list. Commit 8ad342a86359 (\"dmaengine:\nAdd reference counting to dma_device struct\") decoupled the dma_device\nlifetime from the module reference, so the device can now be released\nwhile a reader is still walking the list.\n\nAdd synchronize_rcu() before the device is freed, so RCU readers are\nguaranteed to have finished. Keep it unconditional: providers that do\nnot implement device_release() free the device themselves once\ndma_async_device_unregister() returns. This call will delay for a grace\nperiod with dma_list_mutex held, which is safe and only teardown path is\ndelayed.",
"id": "GHSA-jvjw-jpr2-5gjp",
"modified": "2026-10-06T09:31:36Z",
"published": "2026-10-06T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98342"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.