CVE-2026-98344

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes chan->device->ref only on the slow path: /* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero() dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference. The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded. Fix this by dropping device->ref only on the last put, matching the single slow-path get.

Is your site exposed to CVE-2026-98344?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/036b527f92570206da4b8c40b38f8d689e29d0f3 https://git.kernel.org/stable/c/1a0d9b406febf23054ad595fd47b29325e70fb2d https://git.kernel.org/stable/c/44dab659064eb5c10adb0306510eebe848ed592d https://git.kernel.org/stable/c/57f7f1c6827be7d8f80feca48d2125fb91c6f6ed https://git.kernel.org/stable/c/5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef https://git.kernel.org/stable/c/77906ac448d2fa81fa710ae26c0e591ebdc81154 https://git.kernel.org/stable/c/7c3f4ce651d43705f9ec7f778f642a90d5ff4fba https://git.kernel.org/stable/c/de2677e57d3161390d8a508f08cddec6ef7e4b23

Frequently Asked Questions

What is CVE-2026-98344? +

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes chan->device->ref only on the slow path: /* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero() dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference. The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded. Fix this by dropping device->ref only on the last put, matching the single slow-path get.

How do I check if I'm vulnerable to CVE-2026-98344? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.