Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointer

Impact

A refactor changed dma_direct_alloc_from_pool() to return the CPU virtual address, which suits dma_direct_alloc() but not dma_direct_alloc_pages(), whose caller expects a struct page *. The second caller therefore takes a virtual address and uses it as a page pointer, corrupting whatever it touches. This sits in the core DMA allocation path that accelerator and fabric drivers use for coherent buffers, so it is reachable on any node whose drivers take the atomic-pool path - notably systems where the DMA pool is used under memory pressure or in atomic context. The fix restores the struct page * return and passes the CPU address back through an out-parameter.

Who can reach it

Local and driver-mediated: exercised by kernel drivers calling dma_alloc_pages() on a configuration that routes to the atomic DMA pool. Not directly reachable by an unprivileged tenant; exposure depends on which drivers a node loads.

What to do

Pick up the linked stable commits or a patched distribution kernel and reboot each node. There is no configuration toggle; the affected code is in the core DMA layer.

References

Related entries

• Linux iommu/vt-d: stale context-cache entry on alias teardown lets the IOMMU walk freed PASID tablesCVE-2026-90240 · Linux kernel iommu/vt-d (context-cache invalidation for DMA aliases)High
• Linux iommu/tegra241-cmdqv: multi-stream devices get incomplete vSID mapping, zero-stream devices read out of boundsCVE-2026-90425 · Linux kernel iommu/tegra241-cmdqv (vSID to Stream ID mapping)High
• Linux dw-edma: callbacks fire for terminated transfers, dereferencing freed client stateCVE-2026-93042 · Linux kernel dmaengine dw-edma (terminate-all descriptor handling)High
• QEMU 9pfs: use-after-free race between Tlcreate and Twalk lets a guest escape the shared directory to host filesCVE-2026-93834 · QEMU 9pfs (virtio-9p shared directory, Tlcreate/Twalk race)High
• Linux kernel nvme-fc: error recovery iterates an uninitialized IO tagset when admin connect times outCVE-2026-97409 · Linux kernel nvme-fc (requests cancelled in an uninitialized IO tagset during CONNECTING error recovery)High
• Linux kernel qla2xxx: unserialized NVMe-FC unsolicited-context list can be corrupted by concurrent add and deleteCVE-2026-97527 · Linux kernel scsi qla2xxx (fcport->unsol_ctx_head list unserialized across ISR, DPC and NVMe-FC callbacks)High