In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix device kref underflow in dma chan put()

dma chan get() takes chan->device->ref only on the slow path:

/* no kref on fast path */
if (chan->client count) {
	 module get(owner);
	chan->client count++;
	return 0;
}
if (!try module get(owner))
	return -ENODEV;
if (!dma device get(chan->device)) { // calls kref get unless zero()

dma chan put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference.

The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client count > 0 and another client cycles dmaengine get()/dmaengine put(). When the kref hits zero, the subsequent dma find channel() returns NULL even though the provider module is still loaded.

Fix this by dropping device->ref only on the last put, matching the single slow-path get.