The bug in the dmaengine subsystem causes the device reference counter to underflow when a fast‑path dma_chan_get() is followed by a dma_chan_put() that always drops the reference. This mismatch leaves the device’s reference count negative, which can make a subsequent dma_find_channel() call return NULL while the provider module remains loaded, leading to a null‑pointer dereference and a kernel crash. The effect is a denial of service that terminates the kernel, interrupting all running processes on the affected system.

Linux kernel versions that contain the legacy dmaengine implementation before the reference‑counting fix are vulnerable. The vendor listing indicates the issue is present across all Linux releases that ship the unpatched dmaengine code. Any distribution using a kernel with the vulnerable dmaengine source should verify that the commit correcting the kref underflow has been applied.

The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The CVSS score of 5.5 denotes medium severity. The vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need local kernel privilege or privileged DMA access and the presence of a non‑private provider with a persistent client to trigger the conditions. When the conditions for reference underflow are met, the risk is a potential local denial of service.