CVE-2026-89995

dma-direct: return struct page from dma_direct_alloc_from_pool()

State: Published
Severity: 8.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dma-direct: return struct page from dma_direct_alloc_from_pool()

Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *.

Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 1ca96bbfef42bbfb139cc6eb1d940c8ca9046f95Affected 5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 7801e616fbe3661f9471b2e9bfcb1ed35460bf16Affected 5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before c3fdb94da43ff23287f85664174c45c45e881a3fAffected 5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8Affected 5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before feeb2ef775081a6c188cdd10e7a45369a07ce531Affected 5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 94a04ad732c9f8b9554270fc4038a06737de5c22Affected
LinuxLinux	5.10Affected before 5.10Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 1ca96bbfef42bbfb139cc6eb1d940c8ca9046f95Affected
5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 7801e616fbe3661f9471b2e9bfcb1ed35460bf16Affected
5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before c3fdb94da43ff23287f85664174c45c45e881a3fAffected
5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8Affected
5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before feeb2ef775081a6c188cdd10e7a45369a07ce531Affected
5b138c534fda57c2ebc1e6de72578aa1d70788a6 to before 94a04ad732c9f8b9554270fc4038a06737de5c22Affected

LinuxLinux

5.10Affected
before 5.10Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.