Cloudanix VulnDB

CVE-2026-98416

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux kernel hardware handling code can make some computers crash when memory runs low during setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

NULL pointer dereference in the DMA engine driver when an allocation failure occurs during channel setup, causing the error path to access an uninitialized pointer and crash the kernel.

Why it matters to the business

Unexpected system crashes or denial of service on Linux systems using affected TI DMA hardware, leading to downtime and potential disruption of hardware-accelerated data transfers.

How an attack unfolds

An attacker with local access creates memory pressure to force an allocation failure in the DMA channel request path, triggering the buggy error handler that dereferences a NULL pointer and panics the kernel.

How to fix it

Update the Linux kernel to a patched version that adds a NULL check before the flow release loop in k3_udma_glue_release_rx_chn.

How to confirm the fix worked

Inspect the driver source for the added conditional skip when rx_chn->flows is NULL, or reproduce the allocation-failure error path in a test environment.

Typical attack path

  1. Gain local code execution on the target system
  2. Induce memory exhaustion to cause devm_kcalloc failure
  3. Trigger DMA channel request error path
  4. Crash the kernel via NULL dereference

How to detect it

Search kernel logs and crash dumps for references to k3_udma_glue_release_rx_chn or NULL dereferences in DMA glue release paths.

What your security team should do

  • Prioritize kernel updates on systems using TI K3 UDMA hardware
  • Monitor kernel logs for DMA-related oops and panics
  • Restrict untrusted local access where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). Skip the flow release loop in k3_udma_glue_release_rx_chn() when rx_chn->flows is not allocated. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected packages

Ecosystem Package Introduced Fixed