CVE-2026-98342

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: wait for RCU readers before releasing dma_device

dma_issue_pending_all() walks the dma_device_list with

list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()

unlinks the device with list_del_rcu() and then calls

device->device_release() (which in many drivers, such as plx_dma.c,

directly calls kfree()).

Because there is no grace period between unlinking the device and

freeing it, concurrent RCU readers in dma_issue_pending_all() can

access the device after it has been freed.

The lockless walk originally relied on clients holding a dmaengine

reference to pin the provider module, and therefore the device, for as

long as they might traverse the list. Commit 8ad342a86359 ("dmaengine:

Add reference counting to dma_device struct") decoupled the dma_device

lifetime from the module reference, so the device can now be released

while a reader is still walking the list.

Add synchronize_rcu() before

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References