Riskcovery

CVE-2026-74277

iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

State
Published
Severity
8.8 High
Published
Aug 15, 2026
Updated
Oct 16, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`.

This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists.

Fix this by using `s->length` instead of `sg->length`.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a25e7962db0d79882c9d32fd2a67a02e79129c0e to before 6166cb1344f16dd403f2192f4bea6f6654f1ae1eAffected
  • a25e7962db0d79882c9d32fd2a67a02e79129c0e to before 8646f00ce021e49f4f05bc1d4060a0c27b25d0e1Affected
  • a25e7962db0d79882c9d32fd2a67a02e79129c0e to before db50fb87015b955a5a0c155293b2dd40d63a3b9eAffected
LinuxLinux
  • 6.16Affected
  • before 6.16Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.