CVE-2026-98344 dmaengine: Fix device kref underflow in dma_chan_put()
A reference counting bug in the Linux kernel DMA engine can cause a use-after-free condition, leading to denial of service when specific client interactions occur.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98344?
CVE-2026-98344 is an use after free vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix device kref underflow in dma_chan_put()
dma_chan_get() takes chan->device->ref only on the slow path:
/* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero()
dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference.
The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded.
Fix this by dropping device->ref only on the last put, matching the single slow-path get.
Which versions are affected by CVE-2026-98344?
How do I fix CVE-2026-98344?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98344 being exploited?
There is no known exploitation of CVE-2026-98344 in the wild and no public exploit code.
Sources
Also known as AZL-106251, BELL-CVE-2026-98344, DEBIAN-CVE-2026-98344, GHSA-g4c2-fm3r-x4gh, UBUNTU-CVE-2026-98344.