CVE-2026-90387swiotlb: Preserve allocation virtual address for dynamic pools
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool is backed by remapped virtual addresses, which are not the same as the direct-map addresses returned by phys_to_virt(). swiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address from the physical start address. For atomic-pool backed allocations this stores the wrong address in pool->vaddr. Later, swiotlb_free_tlb() passes that address to dma_free_from_pool(), which will fail to recognize the chunk Pass the virtual address returned by the allocation path into swiotlb_init_io_tlb_pool(), and store that address in pool->vaddr. This keeps the pool free path using the same virtual address as the allocator.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 79636caad3618e2b38457f6e298c9b31ba82b489 builds before 68bf3ebd8e7020dae58e8aa14c7d482738bff9a8; 79636caad3618e2b38457f6e298c9b31ba82b489 builds before 45507dcb0847e96add4455274b12df0eca6590b4; 79636caad3618e2b38457f6e298c9b31ba82b489 builds before 35e0103177826430b5df888b1506239d41e76ab5; from 79636caad3618e2b38457f6e298c9b31ba82b489 before c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319; 79636caad3618e2b38457f6e298c9b31ba82b489 builds before 57d29044d0f29a76c6ec0c112c8c7371d5608dc7 | CNA record |
References
- https://git.kernel.org/stable/c/68bf3ebd8e7020dae58e8aa14c7d482738bff9a8
- https://git.kernel.org/stable/c/45507dcb0847e96add4455274b12df0eca6590b4
- https://git.kernel.org/stable/c/35e0103177826430b5df888b1506239d41e76ab5
- https://git.kernel.org/stable/c/c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319
- https://git.kernel.org/stable/c/57d29044d0f29a76c6ec0c112c8c7371d5608dc7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.