CVE-2026-72476 (GCVE-0-2026-72476)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
dmaengine: Fix possible use after free
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 444f96066937f3fdf0e79b53289cff223c7d638b (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < ab438a9efb9042c79d2f8db28a326d55feb8591f (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 5876f38b67a309c00628942cb25679749b53b397 (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 3b0240483dc977dbec4f3bc7a5383d4691ecb625 (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 329ec20a86091d2a6e5b4fe507545e7d678a22a2 (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 0bc191050c3253da8ef4bfaf157c44efed6e22cd (git)
Affected: 0f571515c332e00b3515dbe0859ceaa30ab66e00 , < 92f853f0645aebf1d05d333e97ab7c342ace1892 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dmaengine.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "444f96066937f3fdf0e79b53289cff223c7d638b",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "ab438a9efb9042c79d2f8db28a326d55feb8591f",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "5876f38b67a309c00628942cb25679749b53b397",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "3b0240483dc977dbec4f3bc7a5383d4691ecb625",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "329ec20a86091d2a6e5b4fe507545e7d678a22a2",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "0bc191050c3253da8ef4bfaf157c44efed6e22cd",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            },
            {
              "lessThan": "92f853f0645aebf1d05d333e97ab7c342ace1892",
              "status": "affected",
              "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/dmaengine.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix possible use after free\n\nIn dma_release_channel(), check chan-\u003edevice-\u003eprivatecnt after call\ndma_chan_put(). However, dma_chan_put() call dma_device_put() which could\nrelease the last reference of the device if the DMA provider is already\ngone and hence free it.\n\nFixes it by moving dma_chan_put() after the check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in dma_release_channel() in drivers/dma/dmaengine.c, reached only when kernel client drivers release a privately requested DMA channel during probe/remove/error teardown triggered by local device access (e.g., /dev/iio:device*, /dev/snd/*, /dev/tty*, spidev), not from any network packet or remote protocol handler.\nAC:L - An attacker can hold a DMA slave channel open via a client device, then close it to call dma_release_channel(); when the DMA provider has already unregistered via unbind, hot-unplug, or module teardown, dma_chan_put() frees dma_device and the subsequent privatecnt access is a reliably triggerable UAF with attacker-controlled release timing.\nPR:L - Exploitation requires only a local unprivileged process able to open a device whose driver uses dma_request_chan() or dma_request_channel(); on embedded ADI FPGA, Android, and industrial platforms, non-root application users commonly have such device-node access without init-namespace root or CAP_SYS_ADMIN.\nUI:N - No victim interaction is required beyond the attacker opening, holding, and closing their own device handle or racing driver teardown; no other user must mount filesystems, approve prompts, or perform separate actions for exploitation to succeed.\nS:U - This is a kernel slab use-after-free in the dmaengine channel-release path affecting the same kernel security authority; it does not cross VM, IOMMU, container, or other sandbox boundaries and is standard in-kernel memory corruption rather than a scope change.\nC:H - After dma_chan_put() frees the last dma_device kref, the code reads and decrements privatecnt and may clear cap_mask on freed kmalloc memory; UAF on dma_device objects enables disclosure of attacker-influenced freed-heap contents per kernel UAF scoring guidance.\nI:H - Post-free modification of privatecnt and cap_mask corrupts reused slab objects under attacker influence, providing a plausible kernel heap corruption path toward arbitrary write primitives, control-flow hijacking, or local privilege escalation.\nA:H - Dereferencing freed dma_device memory during dma_release_channel() can cause KASAN slab-use-after-free reports, kernel oops, BUG, or panic; kernel guidance treats any use-after-free as high availability impact even when full exploitation is not demonstrated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:40.606Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/444f96066937f3fdf0e79b53289cff223c7d638b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab438a9efb9042c79d2f8db28a326d55feb8591f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce"
        },
        {
          "url": "https://git.kernel.org/stable/c/5876f38b67a309c00628942cb25679749b53b397"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b0240483dc977dbec4f3bc7a5383d4691ecb625"
        },
        {
          "url": "https://git.kernel.org/stable/c/329ec20a86091d2a6e5b4fe507545e7d678a22a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bc191050c3253da8ef4bfaf157c44efed6e22cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/92f853f0645aebf1d05d333e97ab7c342ace1892"
        }
      ],
      "title": "dmaengine: Fix possible use after free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72476",
    "datePublished": "2026-08-15T05:57:16.396Z",
    "dateReserved": "2026-08-09T03:40:39.934Z",
    "dateUpdated": "2026-08-17T05:44:40.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72476",
      "date": "2026-09-20",
      "epss": "0.00171",
      "percentile": "0.0686"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/dmaengine.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "444f96066937f3fdf0e79b53289cff223c7d638b",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ab438a9efb9042c79d2f8db28a326d55feb8591f",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5876f38b67a309c00628942cb25679749b53b397",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b0240483dc977dbec4f3bc7a5383d4691ecb625",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "329ec20a86091d2a6e5b4fe507545e7d678a22a2",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0bc191050c3253da8ef4bfaf157c44efed6e22cd",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92f853f0645aebf1d05d333e97ab7c342ace1892",
                    "status": "affected",
                    "version": "0f571515c332e00b3515dbe0859ceaa30ab66e00",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dma/dmaengine.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.30"
                  },
                  {
                    "lessThan": "2.6.30",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix possible use after free\n\nIn dma_release_channel(), check chan-\u003edevice-\u003eprivatecnt after call\ndma_chan_put(). However, dma_chan_put() call dma_device_put() which could\nrelease the last reference of the device if the DMA provider is already\ngone and hence free it.\n\nFixes it by moving dma_chan_put() after the check."
          }
        ],
        "id": "CVE-2026-72476",
        "lastModified": "2026-08-17T06:19:15.607",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:21.757",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0bc191050c3253da8ef4bfaf157c44efed6e22cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/329ec20a86091d2a6e5b4fe507545e7d678a22a2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b0240483dc977dbec4f3bc7a5383d4691ecb625"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/444f96066937f3fdf0e79b53289cff223c7d638b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5876f38b67a309c00628942cb25679749b53b397"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92f853f0645aebf1d05d333e97ab7c342ace1892"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ab438a9efb9042c79d2f8db28a326d55feb8591f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:08:19+00:00",
      "cve": "CVE-2026-72476",
      "id": "CVE-2026-72476",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: Fix possible use after free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72476.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:05:37Z",
      "cve": "CVE-2026-72476",
      "id": "CVE-2026-72476",
      "initial_release_date": "2026-08-27T00:23:42Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72476",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72476.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.