A use-after-free bug in the Linux kernel's DMA engine occurs when dma_device_put() removes the last reference on the dma_device, causing dma_device_release() to free the dma_device and its channels. Subsequently, dma_chan_put() still accesses the now-freed dma_device structure to read the module owner, which results in a memory corruption that KASAN detects. This flaw allows an attacker to execute arbitrary code in kernel space by triggering a DMA channel dereference after the device has been released.

Any Linux kernel version that contains the unpatched implementations of dma_chan_put and dma_release_channel is affected; detailed version information is not supplied, but the fix applies to kernels before the patch commit referenced in the advisory.

Based on the description, the flaw can be triggered by a process that creates a DMA channel that subsequently becomes freed by dma_device_put(), leading to a use-after-free in dma_chan_put(). The likely attack vector is user-space or kernel modules that manage DMA channels. Although the EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, use-after-free bugs in the kernel are high-severity (CVSS 7.0) and may allow an attacker to execute arbitrary code or crash the system.