VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98344: Linux kernel · dmaengine: Fix device kref underflow in dma_chan_put()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in de2677e57d3161390d8a508f08cddec6ef7e4b23 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in de2677e57d3161390d8a508f08cddec6ef7e4b23, 77906ac448d2fa81fa710ae26c0e591ebdc81154, 57f7f1c6827be7d8f80feca48d2125fb91c6f6ed +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8ad342a863590b24ce77681b7e081363fb3333f7, < de2677e57d3161390d8a508f08cddec6ef7e4b23	Fixed in de2677e57d3161390d8a508f08cddec6ef7e4b23
LinuxLinux	Affected ≥ 8ad342a863590b24ce77681b7e081363fb3333f7, < 77906ac448d2fa81fa710ae26c0e591ebdc81154	Fixed in 77906ac448d2fa81fa710ae26c0e591ebdc81154
LinuxLinux	Affected ≥ 8ad342a863590b24ce77681b7e081363fb3333f7, < 57f7f1c6827be7d8f80feca48d2125fb91c6f6ed	Fixed in 57f7f1c6827be7d8f80feca48d2125fb91c6f6ed
LinuxLinux	Affected ≥ 8ad342a863590b24ce77681b7e081363fb3333f7, < 44dab659064eb5c10adb0306510eebe848ed592d	Fixed in 44dab659064eb5c10adb0306510eebe848ed592d
LinuxLinux	Affected ≥ 8ad342a863590b24ce77681b7e081363fb3333f7, < 036b527f92570206da4b8c40b38f8d689e29d0f3	Fixed in 036b527f92570206da4b8c40b38f8d689e29d0f3
LinuxLinux	Affected ≥ 8ad342a863590b24ce77681b7e081363fb3333f7, < 7c3f4ce651d43705f9ec7f778f642a90d5ff4fba	Fixed in 7c3f4ce651d43705f9ec7f778f642a90d5ff4fba

AI-suggested

A fix is available and has been applied in the Linux kernel commits identified by hashes including de2677e57d3161390d8a508f08cddec6ef7e4b23 and others. Users should update to a Linux kernel version that includes these fixes. Since this is a kernel-level issue, applying the official patch or upgrading the kernel is the recommended remediation.

Description

CVE-2026-98344 is a vulnerability in the Linux kernel's dmaengine subsystem where a device reference count underflow occurs in the dma_chan_put() function. This happens because dma_chan_put() unconditionally drops a device reference, causing an extra decrement when paired with fast-path get/put operations. The bug manifests when a non-private provider has a persistent client and another client cycles dmaengine_get()/dmaengine_put(), potentially leading to dma_find_channel() returning NULL despite the provider module still being loaded. The issue has been fixed by adjusting the reference drop to occur only on the last put, matching the slow-path get behavior.

Impact

The underflow of the device reference count can lead to dma_find_channel() returning NULL unexpectedly, which may disrupt DMA channel allocation and usage in affected kernel versions. This could cause failures in DMA operations relying on the dmaengine subsystem, potentially impacting system stability or functionality where DMA channels are critical. There is no indication of remote code execution or privilege escalation from the provided data.

Summary

The Linux kernel dmaengine subsystem had a flaw in reference counting for device objects in dma_chan_put(). Specifically, dma_chan_get() only increments the device reference on the slow path, but dma_chan_put() always decrements it, causing a reference count underflow in fast-path get/put pairs. This underflow can cause dma_find_channel() to return NULL even though the provider module remains loaded, disrupting channel acquisition. The vulnerability requires a scenario where a persistent client holds chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). The fix ensures the device reference is dropped only on the last put, aligning with the single slow-path get.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:38 UTC

Technical details

References

Community reviews

Related threats