CVE-2026-98342

A flaw was found in the Linux kernel's Direct Memory Access (DMA) engine subsystem. A timing flaw allows a device structure to be freed from memory while active read operations are still referencing it. A local attacker could exploit this use-after-free race condition to cause a Denial of Service (DoS) by crashing the kernel or potentially gain elevated privileges.

A race between dma_issue_pending_all() and dma_device_release() can cause a reader to access a dma_device after the provider object has been removed from the global list and freed. The confirmed primitive is a use after free because list_del_rcu() was not followed by an RCU grace period before device_release() could call kfree(). A concurrent reader may dereference stale device fields or traverse stale channel data, causing a kernel crash and potentially creating memory corruption if the freed allocation is reused. For the CVSS the PR:L value represents the paranoid case where a restricted local service account, container root, or other delegated user can influence DMA provider teardown or device lifecycle operations. Typical systems require administrative privileges for driver unload or device removal, which is reflected by PR:H in the base score. The race requires a timing window between provider release and the RCU protected traversal, so AC:H is appropriate. The issue is not directly network reachable. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality, integrity, and privilege escalation impact through reuse of the freed kernel object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.