Linux Kernel EUVD-2026-39255

The vulnerability resides in the Linux kernel's IOMMU DMA subsystem, specifically iommu_dma_iova_link_swiotlb() (iommu/dma.c). SWIOTLB (Software I/O Translation Lookaside Buffer) is a bounce-buffer mechanism used when a DMA-capable device cannot address all physical memory directly - common on systems with IOMMU strict mode or with peripherals that impose DMA address restrictions. The function partitions an unaligned DMA mapping into three segments: a head (unaligned leading bytes), a middle (aligned full pages), and a trailer (unaligned trailing bytes). When the buffer has no aligned pages in the middle, the middle segment has zero length. The code passes this zero length directly to iommu_map(), which the underlying IOMMU page-table driver (iommupt) rejects as an illegal operation. The ensuing error path incorrectly uses offset 0 rather than the actual mapping offset as the starting point for the unlink, corrupting internal IOMMU mapping state. The corruption is not caught immediately but surfaces as a WARN_ON when the corrupted mapping is later destroyed. CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covers the broad kernel tree, with specific enumeration of 7.1 RC1 through RC7 in the CPE data. CWE is not formally assigned, but the root cause class is an unchecked zero-length input to a subsystem that treats zero as an illegal invariant violation, combined with an incorrect error-recovery path - analogous to CWE-754 (Improper Check for Unusual or Exceptional Conditions).