Executive Summary

This vulnerability exists in the Linux kernel's tracing subsystem, specifically in the dma_map_sg tracepoint. When tracing large scatter-gather lists, such as those created by devices like virtio-gpu with large DRM buffers, the number of entries (nents) can exceed 1000. This causes the tracepoint to allocate arrays that exceed the maximum allowed perf buffer size (PERF_MAX_TRACE_SIZE of 8192 bytes), leading to a buffer overflow.

The overflow happens because the combined size of the phys_addrs, dma_addrs, and lengths arrays can reach around 20,000 bytes, which is much larger than the allowed buffer size. This results in warnings and potential instability.

The fix caps the size of these arrays at 128 entries using a minimum function, ensuring that the arrays do not exceed the buffer size limit. This prevents the buffer overflow by limiting memory allocation to a safe size while still recording useful trace data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a buffer overflow in the Linux kernel's tracing subsystem, which may lead to kernel warnings and potentially unstable behavior during performance tracing of devices with large scatter-gather lists.

While the description does not explicitly mention exploitation or direct security breaches, buffer overflows in kernel space can sometimes lead to crashes or denial of service conditions, impacting system reliability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a perf buffer overflow triggered by the dma_map_sg tracepoint when tracing large scatter-gather lists in the Linux kernel.

Detection can involve monitoring kernel logs for warnings related to perf buffer size, such as messages like: "WARNING: CPU: 0 PID: XXXX at kernel/trace/trace_event_perf.c:405 perf buffer not large enough".

You can check kernel logs using commands like:

• dmesg | grep -i perf
• journalctl -k | grep -i perf

Additionally, tracing tools that use the dma_map_sg tracepoint might show truncated data or errors when handling large scatter-gather lists.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by capping the dma_map_sg tracepoint arrays to a maximum of 128 entries, preventing buffer overflow.

Immediate mitigation steps include:

• Update the Linux kernel to a version that includes the fix for this vulnerability (post 2026-03-25).
• Avoid tracing large scatter-gather lists with dma_map_sg tracepoints until the kernel is updated.
• Monitor kernel logs for perf buffer overflow warnings to detect attempts to trigger the vulnerability.

Useful 0 Not Useful 0