CVE-2026-98343 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
A use-after-free in the Linux kernel DMA engine allows local attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98343?
CVE-2026-98343 is an use after free vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels.
dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it:
slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160
Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device.
Which versions are affected by CVE-2026-98343?
How do I fix CVE-2026-98343?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98343 being exploited?
There is no known exploitation of CVE-2026-98343 in the wild and no public exploit code.
Sources
Also known as AZL-106095, BELL-CVE-2026-98343, DEBIAN-CVE-2026-98343, GHSA-rw66-9h9x-4vjf, UBUNTU-CVE-2026-98343.