Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent path

Impact

The non-blocking, non-coherent IOMMU allocation path used dma_alloc_from_pool()'s cpu_addr output to decide whether the allocation succeeded, but that function only fills cpu_addr on success and returns the page itself. On failure the code proceeded to build an IOMMU mapping from an invalid page. The record gives no attacker-controlled path and no mechanism beyond the missing check, so treat this as a failure-path robustness fix in core DMA/IOMMU code rather than a demonstrated escalation; the NVD score of 7.8 is the kernel CNA's standard local rating and is not backed by analysis in the record. It matters here because the same IOMMU DMA layer carries device passthrough and accelerator DMA, and the trigger is memory pressure in atomic context - the condition a node under a heavy training job is already in.

Who can reach it

Local: requires atomic-context non-coherent DMA allocations to fail, i.e. exhaustion of the DMA atomic pool. The record names no authenticated interface an attacker drives directly.

What to do

Pick up a stable kernel containing the listed commits and reboot the node; no configuration workaround is described, and no fixed vendor release is named. Low enough priority to fold into the next scheduled kernel roll rather than an emergency window, unless you have evidence of atomic pool exhaustion on these hosts.

References

Related entries

• Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-freeCVE-2026-90392 · Linux kernel BPF link info (bpf_link_show_fdinfo / bpf_link_get_info_by_fd prog access)High
• Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration failsCVE-2026-90423 · Linux kernel RDMA/rxe (soft-RoCE, on-demand paging MR init error path)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High