CVE-2026-90388

iommu/dma: Check atomic pool allocation result directly

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/dma: Check atomic pool allocation result directly

The non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success.

Do not rely on cpu_addr to detect allocation failure in this path. Check the returned page directly before using it for the IOMMU mapping.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9420139f516d7fbc248ce17f35275cb005ed98ea to before ac9cd0a669b8be5d178dbd471b0d68039dac58b5Affected 9420139f516d7fbc248ce17f35275cb005ed98ea to before db46cb9da83a507d86d2bb080bdb09c865da3d0aAffected 9420139f516d7fbc248ce17f35275cb005ed98ea to before d56c3f955b21e5764c1497e295a5b5d0b3a40470Affected 9420139f516d7fbc248ce17f35275cb005ed98ea to before 06dffc96693083dda3412311406e558cf27f1574Affected 9420139f516d7fbc248ce17f35275cb005ed98ea to before a4ace31d732b657d774e31fb444c0c27d42c78e5Affected 9420139f516d7fbc248ce17f35275cb005ed98ea to before fb0b39287ba894dbdfac2901c51788b63f5c2291Affected 9420139f516d7fbc248ce17f35275cb005ed98ea to before 8c486293ddd0af60991408149fc3e964ea888dc4Affected 9420139f516d7fbc248ce17f35275cb005ed98ea to before af95a0ebc0a0db0762be75f51eadf770bad01aaaAffected 47184b9ddf184cc9a77cf441943a0fe9b7afa575Affected 5.8.6 to before 5.9Affected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

9420139f516d7fbc248ce17f35275cb005ed98ea to before ac9cd0a669b8be5d178dbd471b0d68039dac58b5Affected
9420139f516d7fbc248ce17f35275cb005ed98ea to before db46cb9da83a507d86d2bb080bdb09c865da3d0aAffected
9420139f516d7fbc248ce17f35275cb005ed98ea to before d56c3f955b21e5764c1497e295a5b5d0b3a40470Affected
9420139f516d7fbc248ce17f35275cb005ed98ea to before 06dffc96693083dda3412311406e558cf27f1574Affected
9420139f516d7fbc248ce17f35275cb005ed98ea to before a4ace31d732b657d774e31fb444c0c27d42c78e5Affected
9420139f516d7fbc248ce17f35275cb005ed98ea to before fb0b39287ba894dbdfac2901c51788b63f5c2291Affected
9420139f516d7fbc248ce17f35275cb005ed98ea to before 8c486293ddd0af60991408149fc3e964ea888dc4Affected
9420139f516d7fbc248ce17f35275cb005ed98ea to before af95a0ebc0a0db0762be75f51eadf770bad01aaaAffected
47184b9ddf184cc9a77cf441943a0fe9b7afa575Affected
5.8.6 to before 5.9Affected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.