CVE-2026-90387

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: Preserve allocation virtual address for dynamic pools

swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted

pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the

atomic pool is backed by remapped virtual addresses, which are not the same

as the direct-map addresses returned by phys_to_virt().

swiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address

from the physical start address. For atomic-pool backed allocations this

stores the wrong address in pool->vaddr. Later, swiotlb_free_tlb() passes

that address to dma_free_from_pool(), which will fail to recognize the

chunk

Pass the virtual address returned by the allocation path into

swiotlb_init_io_tlb_pool(), and store that address in pool->vaddr. This

keeps the pool free path using the same virtual address as the allocator.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References