CVE-2026-98344

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix device kref underflow in dma_chan_put()

dma_chan_get() takes chan->device->ref only on the slow path:

/* no kref on fast path */

if (chan->client_count) {

__module_get(owner);

chan->client_count++;

return 0;

}

if (!try_module_get(owner))

return -ENODEV;

if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero()

dma_chan_put() drops the ref unconditionally, so every fast-path

get/put pair drops one extra device reference.

The bug fires when two conditions hold together: a non-private

provider has a persistent client holding chan->client_count > 0

and another client cycles dmaengine_get()/dmaengine_put().

When the kref hits zero, the subsequent dma_find_channel() returns

NULL even though the provider module is still loaded.

Fix this by dropping device->ref only on the last put, matching the

single slow-path get.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References