CVE-2026-89995 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
dma-direct: return struct page from dma_direct_alloc_from_pool()
Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *.
Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's direct memory access subsystem relies on precise handling of memory allocation primitives to ensure data integrity between device drivers and system hardware. A recent regression was introduced in commit 5b138c534fda, which refactored the dma_direct_alloc_from_pool helper function. The primary intent of this change was to streamline the code by having the helper return a CPU virtual address directly from dma_alloc_from_pool. While this modification correctly served the needs of the dma_direct_alloc function, it inadvertently broke the contract expected by dma_direct_alloc_pages. This secondary caller requires a pointer to struct page structures rather than a raw memory address, as these structures are essential for managing physical memory pages within the kernel's virtual memory subsystem.
This mismatch represents a classic type confusion vulnerability where an API consumer receives data of an incorrect type due to improper interface design or refactoring oversight. By returning a CPU address when a struct page pointer is expected, the code introduces undefined behavior that can lead to severe system instability. When dma_direct_alloc_pages attempts to dereference what it believes to be a valid struct page pointer but is actually a memory address, it may access invalid kernel memory locations. This scenario aligns with CWE-823, which describes use of objects with incorrect type attributes, and potentially CWE-119, involving improper restriction of operations within the bounds of a memory buffer if the dereference leads to out-of-bounds access.
The operational impact of this vulnerability is significant for systems relying on DMA operations that utilize page-based allocation paths. If triggered, the error can cause kernel panics or system crashes due to invalid pointer dereferences in critical kernel space code. Furthermore, depending on how the memory manager handles such corrupted pointers, there could be implications for data confidentiality and integrity if adjacent memory structures are inadvertently read or written. Although this is primarily a stability issue rather than an exploitable privilege escalation vector in most contexts, the potential for arbitrary write operations through pointer manipulation cannot be entirely dismissed without exhaustive static analysis of surrounding code paths.
Mitigation strategies involve applying the upstream kernel patch that corrects the return type of dma_direct_alloc_from_pool to struct page . The fix restores the original behavior where the helper returns a struct page , while introducing an output parameter to pass the CPU address back to callers like dma_direct_alloc that require it. System administrators should ensure their kernels are updated with this specific commit or later versions containing the same logical correction. For organizations managing large fleets of Linux systems, automated vulnerability scanning tools configured to detect kernel version regressions related to DMA subsystems can help identify affected instances before they encounter runtime failures during high-load I/O operations.