Linux Kernel CVE-2026-72476

The vulnerability resides in the Linux kernel dmaengine subsystem, specifically in dma_release_channel() within drivers/dma/dmaengine.c. The root cause is an ordering defect: dma_chan_put() is called to decrement the DMA channel reference before the subsequent check of chan->device->privatecnt. Internally, dma_chan_put() calls dma_device_put(), which may drop the final reference to the dma_device structure if the DMA provider driver has already been unregistered (unloaded or hotplugged away), causing the kernel to free that structure. The subsequent privatecnt dereference then operates on freed memory - a textbook CWE-416 use-after-free. The fix reorders the operations so that the privatecnt check occurs prior to invoking dma_chan_put(), eliminating the dangling-pointer window. The CPE string cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* reflects that all Linux kernel builds incorporating the original commit 0f571515c332e00b3515dbe0859ceaa30ab66e00 (introduced in the Linux 2.6.30 era) are affected across all architectures that expose DMA engine channels to userspace or kernel consumers.