CVE-2026-72476

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is in dma_release_channel() in drivers/dma/dmaengine.c, reached only when kernel client drivers release a privately requested DMA channel during probe/remove/error teardown triggered by local device access (e.g., /dev/iio:device*, /dev/snd/*, /dev/tty*, spidev), not from any network packet or remote protocol handler.

AC:LAttack complexity, low

An attacker can hold a DMA slave channel open via a client device, then close it to call dma_release_channel(); when the DMA provider has already unregistered via unbind, hot-unplug, or module teardown, dma_chan_put() frees dma_device and the subsequent privatecnt access is a reliably triggerable UAF with attacker-controlled release timing.

PR:LPrivileges required, low

Exploitation requires only a local unprivileged process able to open a device whose driver uses dma_request_chan() or dma_request_channel(); on embedded ADI FPGA, Android, and industrial platforms, non-root application users commonly have such device-node access without init-namespace root or CAP_SYS_ADMIN.

UI:NUser interaction, none

No victim interaction is required beyond the attacker opening, holding, and closing their own device handle or racing driver teardown; no other user must mount filesystems, approve prompts, or perform separate actions for exploitation to succeed.

S:UScope, unchanged

This is a kernel slab use-after-free in the dmaengine channel-release path affecting the same kernel security authority; it does not cross VM, IOMMU, container, or other sandbox boundaries and is standard in-kernel memory corruption rather than a scope change.

C:HConfidentiality impact, high

After dma_chan_put() frees the last dma_device kref, the code reads and decrements privatecnt and may clear cap_mask on freed kmalloc memory; UAF on dma_device objects enables disclosure of attacker-influenced freed-heap contents per kernel UAF scoring guidance.

I:HIntegrity impact, high

Post-free modification of privatecnt and cap_mask corrupts reused slab objects under attacker influence, providing a plausible kernel heap corruption path toward arbitrary write primitives, control-flow hijacking, or local privilege escalation.

A:HAvailability impact, high

Dereferencing freed dma_device memory during dma_release_channel() can cause KASAN slab-use-after-free reports, kernel oops, BUG, or panic; kernel guidance treats any use-after-free as high availability impact even when full exploitation is not demonstrated.