CVE-2026-98342: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-jvjw-jpr2-5gjp
Share
Published
Advisory Summary

CVE-2026-98342 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98342 at a Glance

CVE Identifier CVE-2026-98342
GHSA Identifier GHSA-jvjw-jpr2-5gjp
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98342

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98342, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlinks the device with list_del_rcu() and then calls device->device_release() (which in many drivers, such as plx_dma.c, directly calls kfree()). Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dma_issue_pending_all() can access the device after it has been freed. The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") decoupled the dma_device lifetime from the module reference, so the device can now be released while a reader is still walking the list. Add synchronize_rcu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement device_release() free the device themselves once dma_async_device_unregister() returns. This call will delay for a grace period with dma_list_mutex held, which is safe and only teardown path is delayed.

References

NVD — CVE-2026-98342 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98342
git.kernel.org/stable/c/14578c7840... WEB
https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8
git.kernel.org/stable/c/4448a539a0... WEB
https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313
git.kernel.org/stable/c/4aed7e47a1... WEB
https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03
git.kernel.org/stable/c/8577a5ec4f... WEB
https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b
git.kernel.org/stable/c/ac8ce9f896... WEB
https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15
git.kernel.org/stable/c/cbb3310a51... WEB
https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee
git.kernel.org/stable/c/dc75042217... WEB
https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f
git.kernel.org/stable/c/fc1f4884f1... WEB
https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77

Frequently Asked Questions

What is CVE-2026-98342?
CVE-2026-98342 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98342?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98342?
CVE-2026-98342 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98342?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jvjw-jpr2-5gjp",
  "modified" : "2026-10-06T09:31:36Z",
  "published" : "2026-10-06T09:31:35Z",
  "aliases" : [ "CVE-2026-98342" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: wait for RCU readers before releasing dma_device\n\ndma_issue_pending_all() walks the dma_device_list with\nlist_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()\nunlinks the device with list_del_rcu() and then calls\ndevice->device_release() (which in many drivers, such as plx_dma.c,\ndirectly calls kfree()).\n\nBecause there is no grace period between unlinking the device and\nfreeing it, concurrent RCU readers in dma_issue_pending_all() can\naccess the device after it has been freed.\n\nThe lockless walk originally relied on clients holding a dmaengine\nreference to pin the provider module, and therefore the device, for as\nlong as they might traverse the list. Commit 8ad342a86359 (\"dmaengine:\nAdd reference counting to dma_device struct\") decoupled the dma_device\nlifetime from the module reference, so the device can now be released\nwhile a reader is still walking the list.\n\nAdd synchronize_rcu() before the device is freed, so RCU readers are\nguaranteed to have finished. Keep it unconditional: providers that do\nnot implement device_release() free the device themselves once\ndma_async_device_unregister() returns. This call will delay for a grace\nperiod with dma_list_mutex held, which is safe and only teardown path is\ndelayed.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98342"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-06T09:18:27Z"
  }
}