CVE-2026-98416: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn()
If devmkcalloc() for rxchn->flows fails in a channel request function, the error path calls k3udmagluereleaserxchn(), which dereferences the NULL rxchn->flows pointer in k3udmagluereleaserxflow().
Skip the flow release loop in k3udmagluereleaserxchn() when rxchn->flows is not allocated.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the NULL dereference?
Allocation of the receive-channel flows array with devm_kcalloc() must fail during a channel request. The resulting error path then releases the receive channel while rx_chn->flows is NULL.
Which systems are exposed?
Systems using the Linux kernel's TI K3 UDMA glue code are relevant. The issue is in receive-channel request error handling rather than normal successful channel operation.
What is the immediate mitigation if an updated kernel cannot be deployed?
No workaround is provided in the available information. The described trigger depends on a memory-allocation failure during receive-channel setup, so avoiding or investigating allocation failures in that path may reduce exposure, but the documented fix is to skip flow release when the flows array was not allocated.