CVE-2026-98416 - Vulnerability Details

- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

If devm_kcalloc() for rx_chn->flows fails in a channel request function,
the error path calls k3_udma_glue_release_rx_chn(), which dereferences
the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow().

Skip the flow release loop in k3_udma_glue_release_rx_chn() when
rx_chn->flows is not allocated.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Published: 2026-10-14

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is a NULL pointer dereference in the TI K3 uDMA glue driver for the Linux DMA engine subsystem. When a channel allocation fails, the error path calls k3_udma_glue_release_rx_chn(), which then dereferences the unallocated rx_chn->flows pointer in k3_udma_glue_release_rx_flow(), leading to a kernel crash. The crash causes a system reboot or halt, representing a denial of service. The weakness is a classic null pointer dereference (CWE‑476) and does not provide arbitrary code execution or privilege escalation.

Affected Systems

All Linux kernel builds that contain the TI K3 uDMA glue driver, regardless of distribution or kernel version, are affected. Kernels lacking the commit that checks for a NULL flows pointer during the release routine are vulnerable. This includes mainstream Linux kernels and vendor‑specific images that use the same driver for TI K3 platforms.

Risk and Exploitability

The CVSS score of 4.1 classifies the vulnerability as Low severity. The EPSS score is <1%, indicating a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. Exploitation would require inducing a DMA channel allocation failure, which is a local condition tied to a user or process with access to the DMA engine; it does not enable remote code execution. The outcome is a system crash, i.e., denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< b51ed7885ab0e8ecad765adc13b465cb1498cdc9
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< b2985956e06632939bee47cee13bccd78ad7c3a1
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< 967612574c542dec71f820a6eb16dea80dd187a1
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< 89f5414660724bb562db4ac74665da16d4a57d99
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< 5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< b14e6c52872556de2d6c137531e0ce85085c10ed
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< 5b2d92b7b177226e1dca2e80dc8369131276c2a4
`d702419134133db1eab2067dc6ea5723467fd917`	affected	< 0294b6dd515256c03ea2dbf508ddd3826d788579

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d702419134133db1eab2067dc6ea5723467fd917,b51ed7885ab0e8ecad765adc13b465cb1498cdc9)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,b2985956e06632939bee47cee13bccd78ad7c3a1)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,967612574c542dec71f820a6eb16dea80dd187a1)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,89f5414660724bb562db4ac74665da16d4a57d99)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,b14e6c52872556de2d6c137531e0ce85085c10ed)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,5b2d92b7b177226e1dca2e80dc8369131276c2a4)`	affected	code_commit	—
`[d702419134133db1eab2067dc6ea5723467fd917,0294b6dd515256c03ea2dbf508ddd3826d788579)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	semver	—
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.112,6.12.*]`	unaffected	generic	—
`[6.18.54,6.18.*]`	unaffected	generic	—
`[7.2.8,7.2.*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit adding the NULL‑check in k3_udma_glue_release_rx_chn()—available in the mainline Linux kernel or vendor‑specific releases.
If a kernel upgrade cannot be performed immediately, disable the k3-udma-glue driver or restrict access to the underlying DMA hardware to prevent allocation failures from reaching the vulnerable code path.
For custom kernel builds, confirm the patch is included before deployment or use distribution‑provided images that incorporate the fix.

Generated by OpenCVE AI on October 16, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98416.mbox
https://git.kernel.org/stable/c/0294b6dd515256c03ea2dbf508ddd3826d788579
https://git.kernel.org/stable/c/5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134
https://git.kernel.org/stable/c/5b2d92b7b177226e1dca2e80dc8369131276c2a4
https://git.kernel.org/stable/c/89f5414660724bb562db4ac74665da16d4a57d99
https://git.kernel.org/stable/c/967612574c542dec71f820a6eb16dea80dd187a1
https://git.kernel.org/stable/c/b14e6c52872556de2d6c137531e0ce85085c10ed
https://git.kernel.org/stable/c/b2985956e06632939bee47cee13bccd78ad7c3a1
https://git.kernel.org/stable/c/b51ed7885ab0e8ecad765adc13b465cb1498cdc9
https://nvd.nist.gov/vuln/detail/CVE-2026-98416
https://www.cve.org/CVERecord?id=CVE-2026-98416

History

Fri, 16 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98416.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98416 https://www.cve.org/CVERecord?id=CVE-2026-98416
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 15 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Thu, 15 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 14 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). Skip the flow release loop in k3_udma_glue_release_rx_chn() when rx_chn->flows is not allocated. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Title		dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0294b6dd515256c03ea2dbf508ddd3826d788579 https://git.kernel.org/stable/c/5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134 https://git.kernel.org/stable/c/5b2d92b7b177226e1dca2e80dc8369131276c2a4 https://git.kernel.org/stable/c/89f5414660724bb562db4ac74665da16d4a57d99 https://git.kernel.org/stable/c/967612574c542dec71f820a6eb16dea80dd187a1 https://git.kernel.org/stable/c/b14e6c52872556de2d6c137531e0ce85085c10ed https://git.kernel.org/stable/c/b2985956e06632939bee47cee13bccd78ad7c3a1 https://git.kernel.org/stable/c/b51ed7885ab0e8ecad765adc13b465cb1498cdc9

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-14T13:27:47.215Z

Updated: 2026-10-19T09:19:10.061Z

Reserved: 2026-09-25T10:25:14.347Z

Link: CVE-2026-98416

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-14T14:17:52.910

Modified: 2026-10-19T10:18:46.953

Link: CVE-2026-98416

Redhat

Severity : Moderate

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98416 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-19T18:00:02Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object