EUVD-2026-59424
GHSA-v74x-xvfc-h3j3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AC raised to H because exploitation requires specific P2PDMA-capable PCIe hardware, IOMMU active, and a multi-segment scatterlist condition not present in standard deployments.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg->length instead of the current entry s->length.
This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists.
Fix this by using s->length instead of sg->length.
AnalysisAI
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a Linux kernel version containing the vulnerable iommu_dma_map_sg() P2PDMA path (between commit a25e7962db0d and the fix commits); (2) an IOMMU enabled and actively managing DMA for PCIe devices (IOMMU=on in kernel configuration and firmware); (3) PCIe hardware capable of Peer-to-Peer DMA - such as NVMe SSDs or GPUs supporting GPU-Direct Storage or NVMe-over-Fabrics P2PDMA; (4) a DMA operation that produces a multi-segment scatterlist (single-segment P2PDMA transfers are not affected by the length-overwrite bug); and (5) local access with at minimum unprivileged filesystem or device I/O capability (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case potential impact of corrupted DMA operations - kernel memory corruption with scope change - but overstates realistic exploitation ease. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local access (PR:L) on a server equipped with PCIe P2PDMA-capable hardware - such as a high-performance storage or compute node with NVMe-oF or GPU-Direct Storage configured - initiates a DMA operation that produces a multi-segment scatterlist traversing the P2PDMA path in iommu_dma_map_sg(). The kernel assigns incorrect lengths to all segments after the first, causing the PCIe device to DMA-read or DMA-write memory at incorrect offsets, potentially exposing sensitive kernel memory regions or overwriting adjacent data structures. … |
| Remediation | The primary fix is to update to a patched Linux kernel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running affected kernel versions with P2PDMA or PCI device passthrough enabled using your asset management and vulnerability scanning tools; prioritize virtualization hosts, database servers, and systems with direct hardware access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today