EUVD-2026-80603
GHSA-36w9-6524-pc79
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local kernel DMA path (AV:L), depends on specific pool/hardware config making it non-deterministic (AC:H), needs local privileges to drive allocations (PR:L); impact is DoS crash (A:H) with no confidentiality (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dma-direct: return struct page from dma_direct_alloc_from_pool()
Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *.
Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller.
AnalysisAI
A functional regression introduced in the Linux kernel's dma-direct allocator by commit 5b138c534fda causes dma_direct_alloc_from_pool() to hand back a CPU address where its caller dma_direct_alloc_pages() expects a struct page pointer, so that path dereferences an address as page metadata and can corrupt state or crash the kernel. Only kernels built with the atomic DMA coherent pool (CONFIG_DMA_COHERENT_POOL) and configurations that route coherent allocations through the atomic pool - typically GFP_ATOMIC or restricted/non-coherent DMA device paths - are exposed, and the bug is reachable only by local kernel/driver DMA activity with low privileges, not over a network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a kernel built with the atomic DMA coherent pool (CONFIG_DMA_COHERENT_POOL) and hardware/allocation contexts that route coherent DMA allocations through dma_direct_alloc_from_pool() - specifically the dma_alloc_pages() / dma_direct_alloc_pages() path, typically hit for GFP_ATOMIC or non-coherent/restricted-DMA devices where allocations fall back to the atomic pool. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a functional regression in the Linux kernel dma-direct allocator, not a remotely triggerable memory-corruption primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the upstream stable fixes identified as 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, or cherry-pick the corresponding stable commits c3fdb94da43ff23287f85664174c45c45e881a3f, 94a04ad732c9f8b9554270fc4038a06737de5c22, 408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8 and feeb2ef775081a6c188cdd10e7a45369a07ce531 from https://git.kernel.org/stable/ as appropriate for your branch; the fault exists from commit 5b138c534fda onward, so any kernel at or after that commit without the fix is unpatched. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems built with CONFIG_DMA_COHERENT_POOL and verify whether they route coherent allocations through the atomic pool; apply the vendor-released patch as soon as it is available per vendor advisory, or if not immediately deployable, restrict local access to trusted users and monitor for kernel crashes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today