CVE-2026-89996 Linux Kernel DMA‑Buf File Descriptor Leak – Analysis, Impact & Mitigation

Executive Summary

CVE-2026-89996 represents a significant vulnerability in the Linux kernel’s DMA heap allocation interface that can lead to file descriptor leaks through race condition exploitation. This vulnerability affects systems utilizing DMA-buf memory sharing mechanisms, particularly in multi-threaded environments. The flaw exists in the DMA_HEAP_IOCTL_ALLOC function, where file descriptors are installed into the process’s file descriptor table before validation completes, creating a window of exposure. Organizations running unpatched Linux kernels should prioritize assessment and remediation to prevent potential resource exhaustion, unauthorized access, and privilege escalation attacks.

What Is CVE-2026-89996?

The Core Vulnerability: File Descriptor Leak in DMAHEAPIOCTL_ALLOC

CVE-2026-89996 is a file descriptor leak vulnerability in the Linux kernel’s DMA heap interface. The vulnerability occurs when the DMA_HEAP_IOCTL_ALLOC ioctl handler allocates a dma-buf and installs its file descriptor into the caller’s file descriptor table before the allocation operation fully completes. If the subsequent copy_to_user() operation fails—whether due to invalid memory addresses, signal interruption, or other transient conditions—the file descriptor remains visible to other threads within the same process despite the operation’s failure.

This creates a critical security gap: a malicious thread can detect the leaked file descriptor and gain unauthorized access to the underlying dma-buf resource before the kernel has an opportunity to clean up the failed allocation.

Why the Linux Kernel’s DMA Heap Interface Is Affected

The DMA heap interface provides userspace applications with direct access to DMA-capable memory pools, essential for graphics rendering, video processing, and high-performance computing workloads. The vulnerability stems from a fundamental ordering issue in the allocation sequence:

1. Memory is allocated from the DMA heap
2. A file descriptor is created and installed into the process’s fd table
3. Allocation metadata is copied to userspace via copy_to_user()

If step 3 fails, steps 1 and 2 have already made the resource visible to the process. In multi-threaded applications, other threads can immediately access this fd before cleanup occurs.

Severity Classification and Risk Level

CVSS v3.1 Base Score: 7.1 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

The vulnerability requires local access and the ability to execute code, but the exploitation difficulty is low due to the inherent race condition. The impact includes:

• Confidentiality: High – Unauthorized access to DMA-buf memory contents
• Integrity: Low – Potential modification of shared memory regions
• Availability: Low to Medium – Resource exhaustion through fd depletion

Technical Breakdown: How the Vulnerability Works

The DMAHEAPIOCTL_ALLOC Function and Its Failure Point

The vulnerable code path in the DMA heap driver follows this sequence:

dma_heap_ioctl_alloc()
  ├─ dma_heap_alloc_buffer()      // Allocates dma-buf
  ├─ fd_install(fd, file)         // Installs fd in current->files
  ├─ copy_to_user(...)            // ← FAILURE POINT
  └─ [cleanup on error]

The critical issue is that fd_install() makes the file descriptor immediately available to all threads in the process. The kernel’s file descriptor table is a shared resource, and once fd_install() completes, any thread can use that fd to access the underlying file object.

If copy_to_user() fails at this point, the error handling path attempts to close the fd, but a race condition window exists where another thread can:

1. Scan the process’s fd table
2. Detect the newly installed fd
3. Call dup(), dup2(), or fcntl() to duplicate or manipulate the fd
4. Retain access even after the original fd is closed

Race Conditions Between copytouser() and File Descriptor Installation

The vulnerability exploits the inherent race condition between fd installation and validation:

Thread A (Vulnerable Path):

copy_to_user(&user_alloc_data, &kernel_alloc_data, sizeof(...))
// Fails due to EFAULT (bad address)
// Returns error

Thread B (Exploitation Window):

// Scanning /proc/self/fd/ or using F_GETFD
// Detects newly installed fd
dup(leaked_fd)  // Duplicates before cleanup
// Now has persistent access

The window is typically microseconds, but modern multi-core systems and careful thread synchronization can reliably exploit this timing.

How Multi-Threaded Applications Expose the Leak

Multi-threaded applications are particularly vulnerable because:

1. Shared fd table: All threads within a process share the same file descriptor table
2. No atomic visibility: The fd becomes visible to other threads immediately upon fd_install()
3. Predictable timing: An attacker can create threads that continuously scan for new fds, increasing the probability of catching the leaked fd during the race window
4. No permission checks: Once a thread has access to an fd, there are no additional permission checks on subsequent operations

A typical exploitation pattern involves:

• Thread 1: Repeatedly calls DMA_HEAP_IOCTL_ALLOC with an invalid userspace buffer
• Thread 2: Continuously monitors /proc/self/fd/ for new entries
• Thread 3: Attempts to duplicate detected fds before cleanup

The Difference Between Intended and Actual Behavior

Intended Behavior:

• Allocate dma-buf
• Create fd
• Copy allocation metadata to userspace
• If any step fails, clean up all resources atomically
• Return error to caller
• No other thread can access the failed allocation

Actual Behavior:

• Allocate dma-buf
• Create fd and install it (visible to all threads)
• Attempt to copy metadata
• If copy fails, close the fd
• But other threads may have already duplicated or accessed it
• Resource leak occurs; attacker retains access

Which Systems and Versions Are Affected

Linux Kernel Versions at Risk

CVE-2026-89996 affects Linux kernel versions that include the DMA heap subsystem without the security fix. The vulnerability was introduced when the DMA heap interface was first implemented and persists through:

• Affected Range: Linux 5.6 through 6.x (prior to patch)
• Specific Vulnerable Versions:
• 5.6.x through 5.19.x (all versions)
• 6.0.x through 6.6.x (all versions)
• 6.7.x through 6.10.x (versions prior to fix commit)

The exact patched version depends on the kernel branch:

• Stable branches receive backports
• Mainline kernel includes the fix in version 6.11+

Hardware and Use Cases Most Vulnerable

Certain hardware platforms and use cases face elevated risk:

High-Risk Platforms:

• ARM-based SoCs: Qualcomm Snapdragon, MediaTek, Samsung Exynos (heavy DMA heap users)
• Embedded Linux systems: IoT devices, automotive ECUs, industrial controllers
• Mobile devices: Android devices using DMA heap for graphics and media
• High-Performance Computing: Systems using GPU/accelerator memory management

High-Risk Use Cases:

• Graphics rendering (Wayland, X11 with DMA-buf)
• Video encoding/decoding
• Machine learning inference on edge devices
• Real-time media processing
• Multi-threaded server applications with DMA operations

How to Identify Your Kernel Version

Determine your kernel version and check vulnerability status:

# Check kernel version
uname -r
# Example output: 5.15.0-86-generic
# Check if DMA heap is enabled
grep -i dma_heap /boot/config-$(uname -r)
# Output: CONFIG_DMABUF_HEAPS=y (vulnerable if present)
# Check loaded modules
lsmod | grep dma_heap
# Verify if system uses DMA-buf
grep -r "dma.buf\|dma_heap" /proc/device-tree/ 2>/dev/null

Interpretation:

• If CONFIG_DMABUF_HEAPS=y and kernel version is in affected range → Vulnerable
• If CONFIG_DMABUF_HEAPS=n → Not vulnerable (feature disabled)
• If kernel version is 6.11+ or patched stable version → Mitigated

Real-World Attack Scenarios

Thread Race Condition Exploitation

Scenario: A malicious application exploits the race condition to gain persistent access to DMA-buf memory.

Attack Flow:

1. Preparation Phase:

• Attacker creates a multi-threaded application
• Thread pool monitors /proc/self/fd/ for new file descriptors
• Attacker identifies a target DMA heap size (e.g., 4MB graphics buffer)

1. Trigger Phase:

• Main thread repeatedly calls DMA_HEAP_IOCTL_ALLOC with invalid userspace buffer
• Each call triggers the race condition window
• Kernel allocates dma-buf and installs fd

1. Exploitation Phase:

• Monitor thread detects new fd in /proc/self/fd/
• Immediately calls dup(fd) to duplicate the file descriptor
• Duplication succeeds before kernel cleanup
• Attacker now has persistent access to the dma-buf

1. Persistence Phase:

• Original fd is closed by kernel error handling
• Duplicated fd remains open and functional
• Attacker can read/write to dma-buf memory
• Access persists across subsequent allocations

Impact: Attacker gains unauthorized access to graphics buffers, video frames, or other sensitive data stored in DMA memory.

File Descriptor Exhaustion and Denial of Service

Scenario: An attacker exhausts system file descriptor limits, causing denial of service.

Attack Flow:

1. Reconnaissance:

• Determine system’s ulimit -n (typically 1024-65536)
• Calculate available fds (total – system reserved)

1. Exhaustion Attack:

• Spawn multiple threads
• Each thread repeatedly triggers DMA_HEAP_IOCTL_ALLOC with invalid buffer
• Leaked fds accumulate faster than cleanup
• System reaches fd limit

1. Denial of Service:

• Legitimate applications cannot open files, sockets, or pipes
• System services fail to function
• SSH connections rejected
• Database connections fail

Impact: Complete system unavailability; legitimate users cannot access services.

Privilege Escalation Through Memory Manipulation

Scenario: An attacker with user privileges escalates to root by manipulating kernel memory.

Attack Flow:

1. Memory Mapping:

• Attacker gains access to dma-buf via fd leak
• Maps dma-buf into userspace using mmap()
• Obtains direct access to kernel-allocated memory

1. Kernel Structure Identification:

• Attacker analyzes memory layout to identify kernel data structures
• Locates capability structures, uid/gid fields, or security contexts
• Uses information disclosure to bypass ASLR

1. Privilege Escalation:

• Modifies uid/gid fields in kernel memory
• Overwrites capability structures
• Calls setuid(0) or similar to trigger privilege check
• Kernel reads modified values, granting root access

1. Post-Exploitation:

• Attacker now has root shell
• Can install rootkits, backdoors, or steal data
• Compromise is persistent and difficult to detect

Impact: Complete system compromise; attacker gains root access.

Why Embedded Systems and HPC Environments Face Higher Risk

Embedded Systems:

• Often run older, unpatched kernels due to vendor support limitations
• DMA heap is heavily used for graphics and media processing
• Limited update mechanisms (firmware updates infrequent)
• Multi-threaded applications are common (media players, UI frameworks)
• Physical access may enable additional exploitation vectors

HPC Environments:

• Utilize DMA-buf for GPU/accelerator memory management
• Run compute-intensive multi-threaded workloads
• Tight performance requirements may disable security features
• Shared compute nodes increase attack surface
• Data sensitivity (research, financial modeling) increases impact

Detection: How to Identify Exploitation Attempts

System Log Indicators and Anomalous Patterns

Monitor system logs for indicators of exploitation:

Kernel Logs (dmesg, /var/log/kern.log):

# Look for repeated allocation failures
dma_heap: allocation failed
dma_heap: copy_to_user failed
# Monitor for excessive error rates
grep "dma_heap.*fail" /var/log/kern.log | wc -l

File Descriptor Anomalies:

# Monitor fd count per process
watch -n 1 'lsof -p <PID> | wc -l'
# Detect rapid fd creation/destruction
strace -e openat,close,dup -p <PID> 2>&1 | grep -E "dma|heap"
# Check for fd table exhaustion
cat /proc/sys/fs/file-nr
# Output: <allocated> <unused> <max>
# Alert if allocated approaches max

Suspicious Patterns:

• Process fd count increasing by >100 fds/second
• Repeated DMA_HEAP_IOCTL_ALLOC calls with invalid buffers
• Multiple threads accessing same fd simultaneously
• Unusual dup() or fcntl() calls on dma-buf fds

Static and Dynamic Analysis Tools for Code Review

Static Analysis:

# Scan source code for vulnerable patterns
grep -r "DMA_HEAP_IOCTL_ALLOC\|dma_heap_alloc" --include="*.c"
# Use Coccinelle to detect unsafe fd handling
spatch --sp-file dma_heap_check.cocci drivers/dma-buf/
# Clang static analyzer
scan-build make drivers/dma-buf/

Dynamic Analysis:

# Use AddressSanitizer to detect memory issues
ASAN_OPTIONS=detect_leaks=1 ./vulnerable_app
# Valgrind for fd tracking
valgrind --track-fds=yes ./vulnerable_app
# SystemTap for runtime monitoring
stap -e 'probe kernel.function("dma_heap_ioctl_alloc") { 
  printf("dma_heap_alloc called by %s
", execname()) 
}'

Runtime Monitoring for Abnormal DMA-Buf Behavior

eBPF-Based Monitoring:

// BPF program to monitor dma_heap_ioctl_alloc calls
#include <uapi/linux/ptrace.h>
BPF_HASH(alloc_map, u64, u64);
TRACEPOINT_PROBE(syscalls, sys_enter_ioctl) {
    u64 cmd = args->cmd;
    if (cmd == DMA_HEAP_IOCTL_ALLOC) {
        u64 pid_tgid = bpf_get_current_pid_tgid();
        alloc_map.update(&pid_tgid, &args->arg);
    }
    return 0;
}

Auditd Rules:

# Monitor DMA heap device access
auditctl -w /dev/dma_heap -p wa -k dma_heap_access
# Track ioctl calls
auditctl -a always,exit -F arch=x86_64 -S ioctl -F dir=/dev -k ioctl_monitor
# Review audit logs
ausearch -k dma_heap_access -ts recent

Baseline Metrics for File Descriptor Allocation

Establish baseline metrics to detect anomalies:

# Baseline: Average fds per process
ps aux | awk '{print $2}' | xargs -I {} sh -c 'echo -n "{}: "; ls /proc/{}/fd 2>/dev/null | wc -l' | awk -F: '{sum+=$2; count++} END {print "Average: " sum/count}'
# Baseline: System-wide fd usage
cat /proc/sys/fs/file-nr
# Record: allocated, unused, max
# Baseline: DMA heap allocation rate
grep "dma_heap" /var/log/kern.log | wc -l
# Alert thresholds
# - Process fd count increase >50% in 1 minute
# - System fd allocation >80% of max
# - DMA heap allocation failures >10/minute

Mitigation and Remediation Steps

Kernel Patching: Version Requirements and Upgrade Path

Immediate Action: Upgrade to patched kernel versions.

Patched Versions:

Upgrade Procedure:

# 1. Verify current version
uname -r
# 2. Update package manager
sudo apt update  # Debian/Ubuntu
sudo yum update  # RHEL/CentOS
# 3. Install patched kernel
sudo apt install linux-image-generic  # Ubuntu
sudo yum install kernel  # CentOS
# 4. Verify new kernel is default
grep "^menuentry" /boot/grub/grub.cfg | head -1
# 5. Reboot
sudo reboot
# 6. Verify patch applied
uname -r

Testing Before Production Deployment:

# Test in staging environment
# 1. Deploy patched kernel
# 2. Run DMA heap stress tests
# 3. Monitor for regressions
# 4. Verify performance impact (<1%)
# 5. Schedule production rollout

Access Control Restrictions for DMA_HEAP Interface

Restrict Device Access:

# Check current permissions
ls -la /dev/dma_heap*
# Restrict to root only
sudo chmod 600 /dev/dma_heap
sudo chown root:root /dev/dma_heap
# Restrict to specific group
sudo groupadd dma_heap_users
sudo chown root:dma_heap_users /dev/dma_heap
sudo chmod 660 /dev/dma_heap
sudo usermod -a -G dma_heap_users <trusted_user>

Disable DMA Heap if Unused:

# Check if DMA heap is in use
lsmod | grep dma_heap
# If not in use, disable in kernel config
# Edit /etc/default/grub
GRUB_CMDLINE_LINUX="... dma_heap.disabled=1"
# Update GRUB
sudo update-grub
sudo reboot

SELinux and AppArmor Configuration for Enhanced Security

SELinux Policy:

# Create custom SELinux policy for DMA heap
cat > dma_heap.te << 'EOF'
policy_module(dma_heap, 1.0.0)
type dma_heap_device_t;
type dma_heap_user_t;
# Allow only specific domains to access DMA heap
allow dma_heap_user_t dma_heap_device_t:chr_file { open read write ioctl };
# Deny all other domains
dontaudit domain dma_heap_device_t:chr_file *;
EOF
# Compile and load policy
checkmodule -M -m -o dma_heap.mod dma_heap.te
semodule_package -o dma_heap.pp -m dma_heap.mod
semodule -i dma_heap.pp
# Label device
semanage fcontext -a -t dma_heap_device_t "/dev/dma_heap(.*)"
restorecon -Rv /dev/dma_heap

AppArmor Profile:

# Create AppArmor profile
cat > /etc/apparmor.d/usr.bin.trusted_app << 'EOF'
#include <tunables/global>
/usr/bin/trusted_app {
  #include <abstractions/base>
  # Allow DMA heap access only
  /dev/dma_heap r,
  /dev/dma_heap ioctl,
  # Deny access to other devices
  deny /dev/mem rwk,
  deny /dev/kmem rwk,
  deny /proc/kcore rwk,
}
EOF
# Load profile
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.trusted_app
# Verify
sudo aa-status | grep trusted_app

Interim Measures If Immediate Patching Isn’t Possible

Short-Term Mitigations:

1. Disable DMA Heap:

   # Add to kernel command line
   dma_heap.disabled=1

1. Restrict Process Capabilities:

   # Remove CAP_SYS_RESOURCE to limit fd allocation
   setcap -r /path/to/app

1. Implement Resource Limits:

   # Limit fds per process
   ulimit -n 1024
   # Set in /etc/security/limits.conf
   * soft nofile 1024
   * hard nofile 2048

1. Monitor and Alert:

   # Set up continuous monitoring
   watch -n 5 'ps aux | awk "{print \$2}" | xargs -I {} sh -c "echo -n \"{}: \"; ls /proc/{}/fd 2>/dev/null | wc -l"'

1. Network Segmentation:

• Isolate systems with DMA heap workloads
• Restrict network access to reduce attack surface
• Implement strict firewall rules

Patch Implementation and Testing

How the Official Fix Restructures the Allocation Path

The official patch restructures the allocation sequence to ensure atomicity:

Before (Vulnerable):

dma_heap_ioctl_alloc() {
    dma_buf = dma_heap_alloc_buffer(...);      // Step 1
    fd = get_unused_fd_flags(...);             // Step 2
    fd_install(fd, file);                      // Step 3 ← FD visible now
    if (copy_to_user(user_data, kernel_data)) // Step 4 ← Can fail
        return -EFAULT;                        // Race window!
}

After (Fixed):

dma_heap_ioctl_alloc() {
    dma_buf = dma_heap_alloc_buffer(...);      // Step 1
    fd = get_unused_fd_flags(...);             // Step 2
    if (copy_to_user(user_data, kernel_data)) // Step 3 ← Validate first
        return -EFAULT;
    fd_install(fd, file);                      // Step 4 ← FD visible only after success
}

Key Changes:

• copy_to_user() is called before fd_install()
• If validation fails, fd is never installed
• No race window for other threads to access the fd
• Atomic from userspace perspective

Testing Patched Kernels in Your Environment

Pre-Deployment Testing:

# 1. Build patched kernel
cd /usr/src/linux
make menuconfig  # Verify CONFIG_DMABUF_HEAPS=y
make -j$(nproc)
make modules_install
make install
# 2. Create test VM/container
docker run -it ubuntu:22.04 /bin/bash
# 3. Install patched kernel
cp /boot/vmlinuz-* /boot/
update-grub
reboot
# 4. Verify patch applied
grep -A 20 "dma_heap_ioctl_alloc" /proc/kallsyms
# 5. Run regression tests
cd /path/to/kernel/tools/testing/selftests/dmabuf
./run_tests.sh
# 6. Stress test
./dma_heap_stress_test --duration 3600 --threads 16
# 7. Monitor for issues
dmesg | grep -i "error\|warning\|fail"

Regression Test Suite:

# Create comprehensive test
cat > dma_heap_test.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <pthread.h>
#define DMA_HEAP_IOCTL_ALLOC _IOWR('H', 0x0, struct dma_heap_allocation_data)
struct dma_heap_allocation_data {
    __u64 len;
    __u32 fd;
    __u32 fd_flags;
};
void *stress_thread(void *arg) {
    int heap_fd = open("/dev/dma_heap/system", O_RDWR);
    struct dma_heap_allocation_data data = {
        .len = 4096,
        .fd_flags = O_CLOEXEC,
    };
    for (int i = 0; i < 1000; i++) {
        ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, &data);
        if (data.fd >= 0) close(data.fd);
    }
    close(heap_fd);
    return NULL;
}
int main() {
    pthread_t threads[16];
    for (int i = 0; i < 16; i++)
        pthread_create(&threads[i], NULL, stress_thread, NULL);
    for (int i = 0; i < 16; i++)
        pthread_join(threads[i], NULL);
    printf("Test completed successfully
");
    return 0;
}
EOF
gcc -o dma_heap_test dma_heap_test.c -lpthread
./dma_heap_test

Rollback Procedures and Risk Assessment

Rollback Plan:

# 1. Identify previous kernel version
grep "^menuentry" /boot/grub/grub.cfg | head -5
# 2. Set GRUB default to previous kernel
sudo grub-set-default 1  # Select second entry
# 3. Update GRUB
sudo update-grub
# 4. Reboot to previous kernel
sudo reboot
# 5. Verify rollback
uname -r
# 6. Investigate issues
dmesg | tail -50
journalctl -xe

Risk Assessment:

Long-Term Security Hardening

Code Review Best Practices for DMA-Buf Interactions

Secure Coding Guidelines:

1. Validate Before Installation:

   // ✓ Correct: Validate before fd_install
   if (copy_to_user(user_ptr, kernel_data, size))
       return -EFAULT;
   fd_install(fd, file);
   // ✗ Wrong: Install before validation
   fd_install(fd, file);
   if (copy_to_user(user_ptr, kernel_data, size))
       return -EFAULT;

1. Use Atomic Operations:

   // ✓ Correct: Atomic fd allocation and installation
   fd = get_unused_fd_flags(flags);
   if (fd < 0) return fd;
   file = dma_buf_getfile(dmabuf, flags);
   if (IS_ERR(file)) {
       put_unused_fd(fd);
       return PTR_ERR(file);
   }
   fd_install(fd, file);

1. Implement Proper Error Handling:

   // ✓ Correct: Clean up on error
   if (copy_to_user(user_data, kernel_data, size)) {
       put_unused_fd(fd);  // Prevent fd leak
       fput(file);
       return -EFAULT;
   }

Code Review Checklist:

• [ ] All fd installations occur after validation
• [ ] Error paths properly clean up resources
• [ ] No race conditions between fd visibility and validation
• [ ] Multi-threaded safety verified
• [ ] Resource limits enforced
• [ ] Audit logging implemented

Monitoring and Alerting Strategy Post-Patch

Continuous Monitoring:

# Prometheus metrics for DMA heap
cat > /etc/prometheus/dma_heap.yml << 'EOF'
global:
  scrape_interval: 15s
scrape_configs:
  - job_name: 'dma_heap'
    static_configs:
      - targets: ['localhost:9100']
    metric_relabel_configs:
      - source_labels: [__name__]
        regex: 'node_filefd.*'
        action: keep
EOF
# Grafana dashboard queries
# - rate(node_filefd_allocated[5m])
# - node_filefd_maximum - node_filefd_allocated
# - increase(dma_heap_alloc_failures[5m])

Alert Rules:

groups:
  - name: dma_heap_alerts
    rules:
      - alert: DMAHeapFDExhaustion
        expr: (node_filefd_allocated / node_filefd_maximum) > 0.8
        for: 5m
        annotations:
          summary: "File descriptor exhaustion detected"
      - alert: DMAHeapAllocationFailures
        expr: increase(dma_heap_alloc_failures[5m]) > 10
        for: 1m
        annotations:
          summary: "Excessive DMA heap allocation failures"
      - alert: AbnormalProcessFDGrowth
        expr: rate(process_open_fds[1m]) > 100
        for: 2m
        annotations:
          summary: "Process opening FDs at abnormal rate"

Staying Informed on Related Kernel Vulnerabilities

Information Sources:

1. Official Channels:

• Linux Kernel Security
• CVE Details
• NVD – National Vulnerability Database

1. Mailing Lists:

   # Subscribe to kernel security mailing list
   # linux-kernel-security@vger.kernel.org
   # oss-security@lists.openwall.com

1. Automated Monitoring:

   # Set up CVE monitoring
   curl -s "https://services.nvd.nist.gov/rest/json/cves/1.0?keyword=linux+kernel+dma" | jq .

1. Distribution Security Advisories:

• Ubuntu: USN Tracker
• Red Hat: Security Advisories
• Debian: Security Tracker

Frequently Asked Questions

**Q: What is a dma-buf and why does it