Use-After-Free Vulnerability Affecting the Linux Kernel DMA Engine Subsystem (CVE-2026-98342)
A Use-After-Free (UAF) vulnerability has been identified within the Linux kernel DMA engine (dmaengine) subsystem, tracked as CVE-2026-98342. The flaw arises from missing Read-Copy Update (RCU) grace period synchronization during device release and unlinking operations. Under specific race conditions, a local attacker or concurrent kernel process could trigger a use-after-free scenario when querying active DMA devices, potentially leading to denial of service (kernel crash) o...
Description
Technical context and vulnerability details
The Linux kernel dmaengine subsystem provides a standardized framework and driver abstraction layer for Direct Memory Access (DMA) controllers, offloading high-throughput memory transfers from the main CPU.
In the kernel implementation, dma_issue_pending_all() walks through the global dma_device_list using list_for_each_entry_rcu() inside an rcu_read_lock() protected critical section. Conversely, dma_device_release() unlinks the target device using list_del_rcu() and subsequently calls the driver-specific device_release() callback, which frees the device memory structure (often via kfree()).
Following changes that decoupled the lifecycle of dma_device structures from provider module reference counting, an unlinked device could be deallocated immediately without waiting for concurrent RCU readers to finish execution. Because there was no mandatory RCU grace period between the unlinking of the device and the invocation of device_release(), concurrent RCU readers traversing dma_device_list could access memory that had already been freed.
The issue has been resolved in upstream Linux stable branches by introducing an unconditional synchronize_rcu() call prior to freeing the device memory structure, guaranteeing that all concurrent RCU read-side critical sections have completed before the memory is released.
Potential Risks & Impact
Potential consequences upon exploitation
- Local denial of service (kernel oops, panic, or unexpected system freeze);
- Kernel memory corruption through use-after-free access;
- Potential local privilege escalation under specific memory exploitation layouts;
- Unintended disclosure of sensitive kernel memory.
Affected systems
Products, components and targeted versions
- Linux kernel versions featuring decoupled dma_device lifecycle tracking prior to patched stable releases;
- Upstream Linux stable branches prior to commits:
- 4aed7e47a10b94ea3c5171e8d1382081accd2e03
- 4448a539a0c39141cccc67be6cacde0f35024313
- 8577a5ec4f7e00443015ef99f646def093121a1b
- 14578c78405d51fa92e4ada4502a45f537c0fcb8
- ac8ce9f89638d6d79875cca7d8ae42566a9bde15;
- Enterprise distributions (including Red Hat, Ubuntu, Debian, SUSE, Oracle Linux) deploying unpatched kernel builds.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update the Linux kernel to the latest stable release provided by your distribution vendor;
- Reboot the system following the kernel package installation to load the updated image;
- Restrict unprivileged access to low-level DMA diagnostic interfaces and device removal operations;
- Monitor kernel message buffers (dmesg) for anomalous RCU stalls, slab corruption warnings, or kernel oops traces.
Sources & External Links
Vendor security advisories and documentation
- https://nvd.nist.gov/vuln/detail/CVE-2026-98342
- https://www.cve.org/CVERecord?id=CVE-2026-98342
- https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15
- https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8
- https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.