Linux Kernel CVE-2026-72146

The vulnerability resides in drivers/dma/sh/rz-dmac.c within the Linux kernel DMA engine subsystem, specifically the Renesas RZ Direct Memory Access Controller driver. The root cause is an improper initialization sequence: request_irq() is invoked before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list heads are initialized. When a hardware DMA interrupt arrives during this narrow initialization window, the IRQ handler dereferences channel->ch_base (still NULL or containing garbage), and the IRQ thread traverses uninitialized list structures - both constituting use-of-uninitialized-resource and a race condition (functionally equivalent to CWE-362 and CWE-908, though NVD has not formally assigned a CWE). The fix reorders initialization so that interrupt registration occurs only after all channel data structures are fully set up, and substitutes dmam_alloc_coherent() for dma_alloc_coherent() to simplify the error unwind path. The vulnerability was introduced at commit 5000d37042a61ca556fde2782ca40dbfa802ea16 and is present in kernel 5.15 and later un-patched stable trees.