---
id: CVE-2026-72476
title: 'dmaengine: Fix possible use after free'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dmaengine: Fix possible use after free

  In dma_release_channel(), check chan->device->privatecnt after call
  dma_chan_put(). However, dma_chan_put() call dma_device_put(…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    444f96066937f3fdf0e79b53289cff223c7d638b
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    ab438a9efb9042c79d2f8db28a326d55feb8591f
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    5876f38b67a309c00628942cb25679749b53b397
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    3b0240483dc977dbec4f3bc7a5383d4691ecb625
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    329ec20a86091d2a6e5b4fe507545e7d678a22a2
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    0bc191050c3253da8ef4bfaf157c44efed6e22cd
  - >-
    Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 <
    92f853f0645aebf1d05d333e97ab7c342ace1892
  - Linux 2.6.30
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:50:35.862393Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:25.895Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72476'
references:
  - url: 'https://git.kernel.org/stable/c/444f96066937f3fdf0e79b53289cff223c7d638b'
  - url: 'https://git.kernel.org/stable/c/ab438a9efb9042c79d2f8db28a326d55feb8591f'
  - url: 'https://git.kernel.org/stable/c/9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce'
  - url: 'https://git.kernel.org/stable/c/5876f38b67a309c00628942cb25679749b53b397'
  - url: 'https://git.kernel.org/stable/c/3b0240483dc977dbec4f3bc7a5383d4691ecb625'
  - url: 'https://git.kernel.org/stable/c/329ec20a86091d2a6e5b4fe507545e7d678a22a2'
  - url: 'https://git.kernel.org/stable/c/0bc191050c3253da8ef4bfaf157c44efed6e22cd'
  - url: 'https://git.kernel.org/stable/c/92f853f0645aebf1d05d333e97ab7c342ace1892'
tags:
  - cve.org
epss: 0.00171
epssPercentile: 0.06042
ingestedAt: '2026-10-16T19:46:24.391Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix possible use after free

In dma_release_channel(), check chan->device->privatecnt after call
dma_chan_put(). However, dma_chan_put() call dma_device_put() which could
release the last reference of the device if the DMA provider is already
gone and hence free it.

Fixes it by moving dma_chan_put() after the check.

## Affected

- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 444f96066937f3fdf0e79b53289cff223c7d638b`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < ab438a9efb9042c79d2f8db28a326d55feb8591f`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 5876f38b67a309c00628942cb25679749b53b397`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 3b0240483dc977dbec4f3bc7a5383d4691ecb625`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 329ec20a86091d2a6e5b4fe507545e7d678a22a2`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 0bc191050c3253da8ef4bfaf157c44efed6e22cd`
- `Linux >= 0f571515c332e00b3515dbe0859ceaa30ab66e00 < 92f853f0645aebf1d05d333e97ab7c342ace1892`
- `Linux 2.6.30`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.