{"id":"CVE-2026-98254","revision":"3556a419ff2f4060ae94811093828384","records":[{"revision":"3556a419ff2f4060ae94811093828384","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98254","aliases":[],"title":"swiotlb: use the adjusted address for the highmem page lookup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: use the adjusted address for the highmem page lookup\n\nswiotlb_bounce() reads the page frame number from the slot's recorded\norig_addr, then advances orig_addr by tlb_offset to reach the address\nthe caller asked about. The highmem branch mixes the two: the offset\nwithin the page comes from the adjusted address, the page from the value\nbefore it.\n\nOnce the adjustment crosses a page boundary the pair no longer describes\none location, and the whole copy lands one page below the intended one\nfor a positive tlb_offset, one above for a negative one. DMA_FROM_DEVICE\nwrites the device data over the wrong page and leaves the intended one\nstale, DMA_TO_DEVICE feeds the device from a page the mapping may not\ncover. Partial syncs through dma_sync_single_range_for_*() are what make\ntlb_offset non-zero.\n\nThe branch test is picked the same way, so a slot recorded in lowmem can\nbe adjusted into highmem and the lowmem path then hands a highmem\naddress to phys_to_virt().\n\nTake both from orig_addr once it is final and keep pfn in the branch\nthat uses it. PhysHighMem() asks the question straight from the address,\nas dma-debug already does.","state":0,"publishedAt":"2026-10-06T08:45:20.736+00:00","modifiedAt":"2026-10-19T09:16:25.551+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/dma/swiotlb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5f89468e2f060031cd89fd4287298e0eaf246bf6\",\n                            \"lessThan\": \"6e53b4d6afbde626255805d438cabb1cac482445\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5f89468e2f060031cd89fd4287298e0eaf246bf6\",\n                            \"lessThan\": \"aa4709813b29db89f2307f968db5d24925dcdeb1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5f89468e2f060031cd89fd4287298e0eaf246bf6\",\n                            \"lessThan\": \"0219b72f5c209732b2f03a8cc0d7240b5e428a99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5f89468e2f060031cd89fd4287298e0eaf246bf6\",\n                            \"lessThan\": \"b7d7914a9ae3097e63d113007e4fb44d33d515b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e6108147dd91b94d1979b110f265710c254c99d5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e77b796eb9b7ca3c1c0d574d0c155f55b59ca8d5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.47\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.12.14\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/dma/swiotlb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/6e53b4d6afbde626255805d438cabb1cac482445","https://git.kernel.org/stable/c/aa4709813b29db89f2307f968db5d24925dcdeb1","https://git.kernel.org/stable/c/0219b72f5c209732b2f03a8cc0d7240b5e428a99","https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98254","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98254","identifiers":["CVE-2026-98254"]},"retained":false,"historicalAffected":[]}],"coverage":[]}