https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:35:52 +0000 https://db.gcve.eu/vuln/cve-2026-90387 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>swiotlb: Preserve allocation virtual address for dynamic pools</p> <p>swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool is backed by remapped virtual addresses, which are not the same as the direct-map addresses returned by phys_to_virt().</p> <p>swiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address from the physical start address. For atomic-pool backed allocations this stores the wrong address in pool-&gt;vaddr. Later, swiotlb_free_tlb() passes that address to dma_free_from_pool(), which will fail to recognize the chunk</p> <p>Pass the virtual address returned by the allocation path into swiotlb_init_io_tlb_pool(), and store that address in pool-&gt;vaddr. This keeps the pool free path using the same virtual address as the allocator.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>swiotlb: Preserve allocation virtual address for dynamic pools</p> <p>swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool is backed by remapped virtual addresses, which are not the same as the direct-map addresses returned by phys_to_virt().</p> <p>swiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address from the physical start address. For atomic-pool backed allocations this stores the wrong address in pool-&gt;vaddr. Later, swiotlb_free_tlb() passes that address to dma_free_from_pool(), which will fail to recognize the chunk</p> <p>Pass the virtual address returned by the allocation path into swiotlb_init_io_tlb_pool(), and store that address in pool-&gt;vaddr. This keeps the pool free path using the same virtual address as the allocator.</p> https://db.gcve.eu/vuln/cve-2026-90387