---
id: CVE-2026-72476
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dmaengine: Fix possible use after free

  In dma_release_channel(), check chan->device->privatecnt after call
  dma_chan_put()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dmaengine: Fix possible use after free

  In dma_release_channel(), check chan->device->privatecnt after call
  dma_chan_put(). However, dma_chan_put() call dma_device_put(…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-825
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:32.340'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72476'
references:
  - url: 'https://git.kernel.org/stable/c/0bc191050c3253da8ef4bfaf157c44efed6e22cd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/329ec20a86091d2a6e5b4fe507545e7d678a22a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3b0240483dc977dbec4f3bc7a5383d4691ecb625'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/444f96066937f3fdf0e79b53289cff223c7d638b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5876f38b67a309c00628942cb25679749b53b397'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/92f853f0645aebf1d05d333e97ab7c342ace1892'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9bdc8dce4068dadbdf7cf5ad6d4983e2afffedce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ab438a9efb9042c79d2f8db28a326d55feb8591f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72476.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-72476'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2516293'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-72476'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72476'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-72476-d0b7@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00171
epssPercentile: 0.06448
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:50:35.862393Z'
scores:
  nvd: 7.8
  vendor: 5.5
  cna: 7.8
ingestedAt: '2026-10-16T19:46:24.391Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix possible use after free

In dma_release_channel(), check chan->device->privatecnt after call
dma_chan_put(). However, dma_chan_put() call dma_device_put() which could
release the last reference of the device if the DMA provider is already
gone and hence free it.

Fixes it by moving dma_chan_put() after the check.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72476.json)