CVE-2026-98242

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len. Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`. Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `check_add_overflow()` for `nents` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98242

EUVD

EUVD-2026-93170

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	3aa31a8bb11e47c0ff2b306988d1756b810c1c3c
Linux	Linux	3aa31a8bb11e47c0ff2b306988d1756b810c1c3c
Linux	Linux	6.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's dma-buf subsystem. It involves a silent overflow when converting physical memory vectors to scatter-gather tables (sgt). When MMIO size exceeds 4GB and peer-to-peer DMA uses the host bridge, a 32-bit variable (mapped_len) accumulates size_t lengths, causing wrap-around truncation. This leads to incorrect lengths being passed to functions like fill_sg_entry.

Detection Guidance

This vulnerability is specific to the Linux kernel's dma-buf subsystem and relates to a silent overflow in phys vec to sgt conversion. Detection requires checking kernel logs for DMA-related errors or examining kernel code for the affected functions. No direct network detection commands are applicable.

Impact Analysis

If exploited, this flaw could cause memory corruption or crashes in systems using DMA with large MMIO regions. It may lead to data corruption, denial of service, or privilege escalation in affected Linux systems. Systems with peer-to-peer DMA and host bridges handling >4GB MMIO are most at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a memory overflow issue in the Linux kernel's dma-buf subsystem, which could lead to data corruption or system instability but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the kernel patch that changes mapped_len to size_t and fixes similar overflow issues in calc_sg_nents. Update to a Linux kernel version that includes this fix. Monitor kernel logs for DMA errors after applying the patch.

Hi! I’m here to help you understand CVE-2026-98242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70