Linux kernel dma-direct: dma_direct_alloc_pages() treats a CPU address as a struct page pointer

Impact

A refactor changed dma_direct_alloc_from_pool() to return the CPU virtual address, which suits dma_direct_alloc() but not dma_direct_alloc_pages(), whose caller expects a struct page *. The second caller therefore takes a virtual address and uses it as a page pointer, corrupting whatever it touches. This sits in the core DMA allocation path that accelerator and fabric drivers use for coherent buffers, so it is reachable on any node whose drivers take the atomic-pool path - notably systems where the DMA pool is used under memory pressure or in atomic context. The fix restores the struct page * return and passes the CPU address back through an out-parameter.

Who can reach it

Local and driver-mediated: exercised by kernel drivers calling dma_alloc_pages() on a configuration that routes to the atomic DMA pool. Not directly reachable by an unprivileged tenant; exposure depends on which drivers a node loads.

What to do

Pick up the linked stable commits or a patched distribution kernel and reboot each node. There is no configuration toggle; the affected code is in the core DMA layer.

References

Related entries

• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
• Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High
• sudo: intercept policy checks skipped for execveat, letting allowed users run denied commandsCVE-2026-82474 · sudo (ptrace-based intercept mode, execveat/fexecve path)High
• Linux kernel (arch/x86/kvm/svm): Hardware ignores the low five bits of CR3 when loading PDPTEs, but KVM's nested SVMCVE-2024-50115 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High