An RCU reader traverses the dma_device list while a device is being unlinked and freed without a grace period. This race condition leaves a dangling pointer that an attacker could dereference, causing a use‑after‑free and kernel memory corruption. The weakness is classified as a use‑after‑free flaw (CWE‑825).

All Linux kernel builds that expose the dmaengine subsystem before the upstream patch that inserts synchronize_rcu() before freeing the device are affected. Mainstream distributions and custom kernels that have not incorporated the fix, including any module that interacts with dmaengine without proper reference counting, remain vulnerable. Kernel releases prior to the synchronization change are at risk.

The CVSS score of 7.0 indicates moderate‑to‑high risk, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker who can control when a dma_device is released, such as by unloading a kernel module that interacts with dmaengine, while RCU readers are still active. Based on the description, it is inferred that a privileged or compromised environment is required to orchestrate the race; actual exploitation would result in kernel memory corruption that could lead to privilege escalation or denial of service.