CVE-2026-98254
Received Received - Intake

Buffer Overflow in Linux Kernel SWIOTLB

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlb_bounce() reads the page frame number from the slot's recorded orig_addr, then advances orig_addr by tlb_offset to reach the address the caller asked about. The highmem branch mixes the two: the offset within the page comes from the adjusted address, the page from the value before it. Once the adjustment crosses a page boundary the pair no longer describes one location, and the whole copy lands one page below the intended one for a positive tlb_offset, one above for a negative one. DMA_FROM_DEVICE writes the device data over the wrong page and leaves the intended one stale, DMA_TO_DEVICE feeds the device from a page the mapping may not cover. Partial syncs through dma_sync_single_range_for_*() are what make tlb_offset non-zero. The branch test is picked the same way, so a slot recorded in lowmem can be adjusted into highmem and the lowmem path then hands a highmem address to phys_to_virt(). Take both from orig_addr once it is final and keep pfn in the branch that uses it. PhysHighMem() asks the question straight from the address, as dma-debug already does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98254
EUVD
EUVD-2026-93182

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 5f89468e2f060031cd89fd4287298e0eaf246bf6
Linux Linux 5f89468e2f060031cd89fd4287298e0eaf246bf6
Linux Linux 5f89468e2f060031cd89fd4287298e0eaf246bf6
Linux Linux 5f89468e2f060031cd89fd4287298e0eaf246bf6
Linux Linux e6108147dd91b94d1979b110f265710c254c99d5
Linux Linux e77b796eb9b7ca3c1c0d574d0c155f55b59ca8d5
Linux Linux 5.10.47
Linux Linux 5.12.14
Linux Linux 5.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of high memory addresses during DMA operations. The swiotlb_bounce function miscalculates the page frame number by mixing adjusted and unadjusted addresses, causing DMA operations to read or write to the wrong memory pages. This can lead to data corruption or exposure depending on the direction of the DMA transfer.

Impact Analysis

This vulnerability may cause system instability, data corruption, or unauthorized memory access. If exploited, it could allow attackers to read sensitive data from incorrect memory locations or overwrite critical system memory, potentially leading to crashes or privilege escalation.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this swiotlb issue. Monitor kernel security advisories for the specific kernel version addressing CVE-2026-98254.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart