CVE-2026-98416 in Linux
Summary
by MITRE • 10/14/2026
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow().
Skip the flow release loop in k3_udma_glue_release_rx_chn() when rx_chn->flows is not allocated.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the Texas Instruments K3 Universal DMA glue driver for the Linux kernel, specifically in the function k3_udma_glue_release_rx_chn(). This issue manifests as a NULL pointer dereference that occurs during error handling paths when resource allocation fails. The root cause lies in an incomplete initialization sequence where memory allocated via devm_kcalloc() for the rx_chn->flows structure may fail to allocate successfully. In such failure scenarios, the kernel's error path invokes k3_udma_glue_release_rx_chn() to clean up partially initialized resources. However, this cleanup function proceeds to call k3_udma_glue_release_rx_flow(), which attempts to dereference the rx_chn->flows pointer without verifying its validity first. Since the allocation failed, this pointer remains NULL, leading directly to a kernel panic or system crash upon access.
From a technical perspective, this flaw represents a classic race condition between resource acquisition and cleanup logic, often categorized under CWE-476: NULL Pointer Dereference. The vulnerability is triggered during channel request operations where dynamic memory allocation for flow structures is required. If the underlying memory subsystem cannot satisfy the request due to exhaustion or other constraints, the driver fails to account for this state before attempting deallocation. This oversight violates the principle of defensive programming, which dictates that all pointers must be validated against NULL prior to dereferencing, especially in error paths where partial initialization is common. The issue was detected using static analysis tools from the Linux Verification Center with SVACE, highlighting the importance of automated verification in identifying such subtle logic errors during development cycles.
The operational impact of this vulnerability can range from local denial-of-service conditions to potential privilege escalation depending on the context and kernel configuration. A NULL pointer dereference in kernel space typically results in an oops or panic, effectively crashing the entire system if not handled by a fault handler that allows recovery. In embedded systems utilizing TI K3 SoCs, such crashes could disrupt critical real-time data processing tasks managed by the DMA engine, leading to service interruptions in industrial control networks, automotive infotainment systems, or telecommunications infrastructure where these drivers are commonly deployed. While exploitation for arbitrary code execution is unlikely given the nature of NULL dereferences, the reliability and stability implications remain significant for production environments requiring high availability.
Mitigation strategies involve applying the upstream kernel patch that modifies k3_udma_glue_release_rx_chn() to check if rx_chn->flows is non-NULL before entering the flow release loop. This simple conditional guard ensures that cleanup routines only operate on valid memory regions, thereby preventing illegal memory accesses during error handling. Administrators should ensure their systems are updated with kernel versions containing this fix. Additionally, developers implementing similar drivers should adopt rigorous static analysis practices and incorporate explicit NULL checks in all deallocation paths to prevent recurrence of such issues across the broader Linux ecosystem.