{"id":"CVE-2026-72476","revision":"d2d601afce9f4a9c97f9082fe5cb28ed","records":[{"revision":"d2d601afce9f4a9c97f9082fe5cb28ed","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72476","aliases":[],"title":"dmaengine: Fix possible use after free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix possible use after free\n\nIn dma_release_channel(), check chan->device->privatecnt after call\ndma_chan_put(). However, dma_chan_put() call dma_device_put() which could\nrelease the last reference of the device if the DMA provider is already\ngone and hence free it.\n\nFixes it by moving dma_chan_put() after the check.","state":0,"publishedAt":"2026-08-15T05:57:16.396+00:00","modifiedAt":"2026-10-16T18:55:25.895+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/dma/dmaengine.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"444f96066937f3fdf0e79b53289cff223c7d638b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"ab438a9efb9042c79d2f8db28a326d55feb8591f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"5876f38b67a309c00628942cb25679749b53b397\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"3b0240483dc977dbec4f3bc7a5383d4691ecb625\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"329ec20a86091d2a6e5b4fe507545e7d678a22a2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"0bc191050c3253da8ef4bfaf157c44efed6e22cd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0f571515c332e00b3515dbe0859ceaa30ab66e00\",\n                            \"lessThan\": \"92f853f0645aebf1d05d333e97ab7c342ace1892\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/dma/dmaengine.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.30\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.30\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/444f96066937f3fdf0e79b53289cff223c7d638b","https://git.kernel.org/stable/c/ab438a9efb9042c79d2f8db28a326d55feb8591f","https://git.kernel.org/stable/c/9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce","https://git.kernel.org/stable/c/5876f38b67a309c00628942cb25679749b53b397","https://git.kernel.org/stable/c/3b0240483dc977dbec4f3bc7a5383d4691ecb625","https://git.kernel.org/stable/c/329ec20a86091d2a6e5b4fe507545e7d678a22a2","https://git.kernel.org/stable/c/0bc191050c3253da8ef4bfaf157c44efed6e22cd","https://git.kernel.org/stable/c/92f853f0645aebf1d05d333e97ab7c342ace1892"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72476","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72476","identifiers":["CVE-2026-72476"]},"retained":false,"historicalAffected":[]}],"coverage":[]}