CVE-2026-98416

dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

State: Published
Severity: Not scored
Published: Oct 14, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow().

Skip the flow release loop in k3_udma_glue_release_rx_chn() when rx_chn->flows is not allocated.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d702419134133db1eab2067dc6ea5723467fd917 to before b51ed7885ab0e8ecad765adc13b465cb1498cdc9Affected d702419134133db1eab2067dc6ea5723467fd917 to before b2985956e06632939bee47cee13bccd78ad7c3a1Affected d702419134133db1eab2067dc6ea5723467fd917 to before 967612574c542dec71f820a6eb16dea80dd187a1Affected d702419134133db1eab2067dc6ea5723467fd917 to before 89f5414660724bb562db4ac74665da16d4a57d99Affected d702419134133db1eab2067dc6ea5723467fd917 to before 5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134Affected d702419134133db1eab2067dc6ea5723467fd917 to before b14e6c52872556de2d6c137531e0ce85085c10edAffected d702419134133db1eab2067dc6ea5723467fd917 to before 5b2d92b7b177226e1dca2e80dc8369131276c2a4Affected d702419134133db1eab2067dc6ea5723467fd917 to before 0294b6dd515256c03ea2dbf508ddd3826d788579Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d702419134133db1eab2067dc6ea5723467fd917 to before b51ed7885ab0e8ecad765adc13b465cb1498cdc9Affected
d702419134133db1eab2067dc6ea5723467fd917 to before b2985956e06632939bee47cee13bccd78ad7c3a1Affected
d702419134133db1eab2067dc6ea5723467fd917 to before 967612574c542dec71f820a6eb16dea80dd187a1Affected
d702419134133db1eab2067dc6ea5723467fd917 to before 89f5414660724bb562db4ac74665da16d4a57d99Affected
d702419134133db1eab2067dc6ea5723467fd917 to before 5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134Affected
d702419134133db1eab2067dc6ea5723467fd917 to before b14e6c52872556de2d6c137531e0ce85085c10edAffected
d702419134133db1eab2067dc6ea5723467fd917 to before 5b2d92b7b177226e1dca2e80dc8369131276c2a4Affected
d702419134133db1eab2067dc6ea5723467fd917 to before 0294b6dd515256c03ea2dbf508ddd3826d788579Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.