CVE-2026-98343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98343", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.343Z", "datePublished": "2026-10-06T08:46:33.196Z", "dateUpdated": "2026-10-19T09:17:54.287Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:54.287Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()\n\nWhen dma_device_put() drops the last reference on chan->device->ref,\ndma_device_release() runs and may free the dma_device along with its\nchannels.\n\ndma_chan_put() then still reads chan->device->owner via\ndma_chan_to_owner() for the trailing module_put(). KASAN catches it:\n\n\tslab-use-after-free in dma_chan_put+0x3e6/0x4c0\n\tRead of size 8 by task insmod/6319\n\tFreed by task 6319:\n\t kfree+0x225/0x470\n\t dma_chan_put+0x395/0x4c0\n\t dmaengine_put+0xf8/0x160\n\nCache the module owner in dma_chan_put() before the put so the trailing\nmodule_put() does not need chan->device."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/dmaengine.c"], "versions": [{"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "b92c502595336a3cc5bb7a060170891366745a5d", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "855187a88bdf762c46b6849307597e3e02bfc1d9", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "c9780b601438137494b407eb4301bb3de2587ac9", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "07eb075b60d565a5e465a1945a80cc62807492ad", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "9319dd64d5cdef851841c091f30424faa2284c31", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "6cf31716b77a71c0d634106f4f3951377b8dc6dc", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "02bd02c585293634b213b142cba63cbf77891f6b", "status": "affected", "versionType": "git"}, {"version": "8ad342a863590b24ce77681b7e081363fb3333f7", "lessThan": "e873c74132f0c5f1452816cd9bb26208f0bba1e1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/dmaengine.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b92c502595336a3cc5bb7a060170891366745a5d"}, {"url": "https://git.kernel.org/stable/c/855187a88bdf762c46b6849307597e3e02bfc1d9"}, {"url": "https://git.kernel.org/stable/c/c9780b601438137494b407eb4301bb3de2587ac9"}, {"url": "https://git.kernel.org/stable/c/07eb075b60d565a5e465a1945a80cc62807492ad"}, {"url": "https://git.kernel.org/stable/c/9319dd64d5cdef851841c091f30424faa2284c31"}, {"url": "https://git.kernel.org/stable/c/6cf31716b77a71c0d634106f4f3951377b8dc6dc"}, {"url": "https://git.kernel.org/stable/c/02bd02c585293634b213b142cba63cbf77891f6b"}, {"url": "https://git.kernel.org/stable/c/e873c74132f0c5f1452816cd9bb26208f0bba1e1"}], "title": "dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/dmaengine.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b92c502595336a3cc5bb7a060170891366745a5d", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "855187a88bdf762c46b6849307597e3e02bfc1d9", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "c9780b601438137494b407eb4301bb3de2587ac9", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "07eb075b60d565a5e465a1945a80cc62807492ad", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "9319dd64d5cdef851841c091f30424faa2284c31", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "6cf31716b77a71c0d634106f4f3951377b8dc6dc", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "02bd02c585293634b213b142cba63cbf77891f6b", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}, {"lessThan": "e873c74132f0c5f1452816cd9bb26208f0bba1e1", "status": "affected", "version": "8ad342a863590b24ce77681b7e081363fb3333f7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/dmaengine.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()\n\nWhen dma_device_put() drops the last reference on chan->device->ref,\ndma_device_release() runs and may free the dma_device along with its\nchannels.\n\ndma_chan_put() then still reads chan->device->owner via\ndma_chan_to_owner() for the trailing module_put(). KASAN catches it:\n\n\tslab-use-after-free in dma_chan_put+0x3e6/0x4c0\n\tRead of size 8 by task insmod/6319\n\tFreed by task 6319:\n\t kfree+0x225/0x470\n\t dma_chan_put+0x395/0x4c0\n\t dmaengine_put+0xf8/0x160\n\nCache the module owner in dma_chan_put() before the put so the trailing\nmodule_put() does not need chan->device."}], "id": "CVE-2026-98343", "lastModified": "2026-10-19T10:18:36.690", "metrics": {}, "published": "2026-10-06T09:18:27.163", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/02bd02c585293634b213b142cba63cbf77891f6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07eb075b60d565a5e465a1945a80cc62807492ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6cf31716b77a71c0d634106f4f3951377b8dc6dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/855187a88bdf762c46b6849307597e3e02bfc1d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9319dd64d5cdef851841c091f30424faa2284c31"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b92c502595336a3cc5bb7a060170891366745a5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9780b601438137494b407eb4301bb3de2587ac9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e873c74132f0c5f1452816cd9bb26208f0bba1e1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()", "id": "2546500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546500"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()\nWhen dma_device_put() drops the last reference on chan->device->ref,\ndma_device_release() runs and may free the dma_device along with its\nchannels.\ndma_chan_put() then still reads chan->device->owner via\ndma_chan_to_owner() for the trailing module_put(). KASAN catches it:\nslab-use-after-free in dma_chan_put+0x3e6/0x4c0\nRead of size 8 by task insmod/6319\nFreed by task 6319:\nkfree+0x225/0x470\ndma_chan_put+0x395/0x4c0\ndmaengine_put+0xf8/0x160\nCache the module owner in dma_chan_put() before the put so the trailing\nmodule_put() does not need chan->device.", "A flaw was found in the Linux kernel. A local user can exploit a use-after-free vulnerability in the Direct Memory Access (DMA) engine to cause a Denial of Service (DoS) via a system crash. The issue occurs when the channel cleanup routine attempts to access device information after the underlying device memory has already been freed. This flaw is triggered during channel release operations, resulting in memory corruption and kernel instability."], "name": "CVE-2026-98343", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98343\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98343\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98343.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,b92c502595336a3cc5bb7a060170891366745a5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,855187a88bdf762c46b6849307597e3e02bfc1d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,c9780b601438137494b407eb4301bb3de2587ac9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,07eb075b60d565a5e465a1945a80cc62807492ad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,9319dd64d5cdef851841c091f30424faa2284c31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,6cf31716b77a71c0d634106f4f3951377b8dc6dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,02bd02c585293634b213b142cba63cbf77891f6b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ad342a863590b24ce77681b7e081363fb3333f7,e873c74132f0c5f1452816cd9bb26208f0bba1e1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.271,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.54,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.8,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:45:18.454737+00:00", "updated": "2026-10-11T04:45:17.725542+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}