The Linux kernel contains a use-after-free flaw in the DMA engine subsystem. When dma_release_channel() deallocates a DMA channel, it checks the device reference count after invoking dma_chan_put(), which internally calls dma_device_put(). If the DMA provider has already been removed, dma_device_put() frees the device memory, leaving dma_release_channel() to access memory that has been reclaimed. This can cause a kernel crash or, under the right conditions, allow arbitrary code execution. The weakness is a classic use-after-free caused by a race condition in reference counting.

All Linux kernel builds that contain the older DMA engine implementation before the change referenced by the commit series in the provided URLs are affected. The fix was introduced by moving the dma_chan_put() call after the device reference check. Thus, any kernel version that has not yet applied this change—Linux kernels for the Linux vendor—remains vulnerable, although specific version numbers are not listed.

Because the vulnerability requires the ability to allocate and free DMA channels and to trigger the race condition, it is a local kernel-level issue that could lead to a system crash or privilege escalation. The CVSS score is 7.8, EPSS is < 1%, and it is not listed in KEV, so the quantitative risk is uncertain; nevertheless the nature of the flaw warrants high severity when local privilege is available, and the lack of a known exploit suggests the exploitation likelihood is moderate until active exploitation appears.