CVE-2026-98343

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

When dma_device_put() drops the last reference on chan->device->ref,

dma_device_release() runs and may free the dma_device along with its

channels.

dma_chan_put() then still reads chan->device->owner via

dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

slab-use-after-free in dma_chan_put+0x3e6/0x4c0

Read of size 8 by task insmod/6319

Freed by task 6319:

kfree+0x225/0x470

dma_chan_put+0x395/0x4c0

dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing

module_put() does not need chan->device.