CVE-2026-72476

A flaw was found in the dmaengine component of the Linux kernel. This flaw occurs in the dma_release_channel() function due to an incorrect order of operations, where a channel's reference count is decremented before verifying if the device is still in use. This can lead to a use-after-free vulnerability, potentially causing system instability or a denial of service.

A moderate use-after-free flaw was found in the dmaengine subsystem of the Linux kernel as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. In dma_release_channel(), the code calls dma_chan_put() before checking chan->device->privatecnt. dma_chan_put() calls dma_device_put(), which can drop the last reference to the DMA device when the DMA provider is already gone, causing the device object to be freed while the subsequent privatecnt check still dereferences it. A local user able to trigger the release of a DMA channel during provider teardown could exploit this use-after-free to crash the kernel, resulting in a denial of service; in the worst case, memory corruption from the use of the freed device object could have broader consequences.

Red Hat has rated this flaw as having MODERATE impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to the DMA channel release path and the primary practical consequence is a kernel panic. This is lower than the upstream CVEORG score of 7.8, which additionally assumes high confidentiality and integrity impact from the memory corruption.

The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected. Fixes for these streams have been deferred and are planned for a future update; until then, the residual risk is primarily local denial of service via a kernel crash. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.