CVE-2026-98416: Linux kernel · dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in b2985956e06632939bee47cee13bccd78ad7c3a1 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 17:16 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in b2985956e06632939bee47cee13bccd78ad7c3a1, b51ed7885ab0e8ecad765adc13b465cb1498cdc9, b14e6c52872556de2d6c137531e0ce85085c10ed +5
Exploitation evidence
Disclosed: evidence found.
CVE published 14 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
This vulnerability has been fixed in several Linux kernel commits as listed in the established facts. Users and administrators should update their Linux kernel to a version that includes these fixes. Since this is a kernel-level issue, applying the official patches or upgrading to a fixed kernel version is the recommended mitigation.
Description
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's dmaengine ti k3-udma-glue driver. The issue occurs in the k3_udma_glue_release_rx_chn() function when devm_kcalloc() fails to allocate memory for rx_chn->flows, leading to a NULL dereference during cleanup. The fix involves skipping the flow release loop if rx_chn->flows is not allocated.
References
- git.kernel.org/stable/c/b51ed7885ab0e8ecad765adc13b465cb1498cdc9 (opens in a new tab)
- git.kernel.org/stable/c/b2985956e06632939bee47cee13bccd78ad7c3a1 (opens in a new tab)
- git.kernel.org/stable/c/967612574c542dec71f820a6eb16dea80dd187a1 (opens in a new tab)
- git.kernel.org/stable/c/89f5414660724bb562db4ac74665da16d4a57d99 (opens in a new tab)
- git.kernel.org/stable/c/5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134 (opens in a new tab)
- git.kernel.org/stable/c/b14e6c52872556de2d6c137531e0ce85085c10ed (opens in a new tab)
- git.kernel.org/stable/c/5b2d92b7b177226e1dca2e80dc8369131276c2a4 (opens in a new tab)
- git.kernel.org/stable/c/0294b6dd515256c03ea2dbf508ddd3826d788579 (opens in a new tab)