Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98342

dmaengine: wait for RCU readers before releasing dma_device

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()). Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed. The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list. Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < ac8ce9f89638d6d79875cca7d8ae42566a9bde15affected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < 14578c78405d51fa92e4ada4502a45f537c0fcb8affected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < cbb3310a5167e868a5e763e32b9a23b4d50669eeaffected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < 8577a5ec4f7e00443015ef99f646def093121a1baffected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < 4448a539a0c39141cccc67be6cacde0f35024313affected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77affected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < 4aed7e47a10b94ea3c5171e8d1382081accd2e03affected
  • 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 to < dc750422170a563c7a81f6e49d36bb02c62ae37faffected

Linux Linux

Default version status: affected

  • 2.6.29affected
  • 0 to < 2.6.29unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References