dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

Summary

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() If devm_kcalloc() for rx_chn->flows fails in a channel request function, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow(). Skip the flow release loop in k3_udma_glue_release_rx_chn() when rx_chn->flows is not allocated. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Timeline

1. Oct 14, 2026, 1:27 PM UTCCVE published
2. Oct 19, 2026, 9:19 AM UTCRecord last updated

Affected versions

• Linux Linux

  From d702419134133db1eab2067dc6ea5723467fd917 · fixed in b51ed7885ab0e8ecad765adc13b465cb1498cdc9; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in b2985956e06632939bee47cee13bccd78ad7c3a1; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in 967612574c542dec71f820a6eb16dea80dd187a1; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in 89f5414660724bb562db4ac74665da16d4a57d99; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in 5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in b14e6c52872556de2d6c137531e0ce85085c10ed; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in 5b2d92b7b177226e1dca2e80dc8369131276c2a4; From d702419134133db1eab2067dc6ea5723467fd917 · fixed in 0294b6dd515256c03ea2dbf508ddd3826d788579

• Linux Linux

  5.6

• KernelLinux

  From 5.6.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8

References 8