CVE-2026-90387 (GCVE-0-2026-90387)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:55
VLAI
Title
swiotlb: Preserve allocation virtual address for dynamic pools
Summary
In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool is backed by remapped virtual addresses, which are not the same as the direct-map addresses returned by phys_to_virt(). swiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address from the physical start address. For atomic-pool backed allocations this stores the wrong address in pool->vaddr. Later, swiotlb_free_tlb() passes that address to dma_free_from_pool(), which will fail to recognize the chunk Pass the virtual address returned by the allocation path into swiotlb_init_io_tlb_pool(), and store that address in pool->vaddr. This keeps the pool free path using the same virtual address as the allocator.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 79636caad3618e2b38457f6e298c9b31ba82b489 , < 68bf3ebd8e7020dae58e8aa14c7d482738bff9a8 (git)
Affected: 79636caad3618e2b38457f6e298c9b31ba82b489 , < 45507dcb0847e96add4455274b12df0eca6590b4 (git)
Affected: 79636caad3618e2b38457f6e298c9b31ba82b489 , < 35e0103177826430b5df888b1506239d41e76ab5 (git)
Affected: 79636caad3618e2b38457f6e298c9b31ba82b489 , < c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319 (git)
Affected: 79636caad3618e2b38457f6e298c9b31ba82b489 , < 57d29044d0f29a76c6ec0c112c8c7371d5608dc7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68bf3ebd8e7020dae58e8aa14c7d482738bff9a8",
              "status": "affected",
              "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
              "versionType": "git"
            },
            {
              "lessThan": "45507dcb0847e96add4455274b12df0eca6590b4",
              "status": "affected",
              "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
              "versionType": "git"
            },
            {
              "lessThan": "35e0103177826430b5df888b1506239d41e76ab5",
              "status": "affected",
              "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
              "versionType": "git"
            },
            {
              "lessThan": "c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319",
              "status": "affected",
              "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
              "versionType": "git"
            },
            {
              "lessThan": "57d29044d0f29a76c6ec0c112c8c7371d5608dc7",
              "status": "affected",
              "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: Preserve allocation virtual address for dynamic pools\n\nswiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted\npool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the\natomic pool is backed by remapped virtual addresses, which are not the same\nas the direct-map addresses returned by phys_to_virt().\n\nswiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address\nfrom the physical start address. For atomic-pool backed allocations this\nstores the wrong address in pool-\u003evaddr. Later, swiotlb_free_tlb() passes\nthat address to dma_free_from_pool(), which will fail to recognize the\nchunk\n\nPass the virtual address returned by the allocation path into\nswiotlb_init_io_tlb_pool(), and store that address in pool-\u003evaddr. This\nkeeps the pool free path using the same virtual address as the allocator."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The mismatch is kernel-internal: swiotlb_init_io_tlb_pool() stored phys_to_virt(start) instead of the remapped cpu_addr from dma_alloc_from_pool(), not bytes from a protocol message. Local I/O reaches it via dma_map_page_attrs() \u2192 dma_direct_map_phys() \u2192 swiotlb_map() \u2192 swiotlb_tbl_map_single() \u2192 swiotlb_find_slots() GFP_NOWAIT transient allocation.\nAC:L - On an ARM64 realm guest force_dma_unencrypted() is true, so every GFP_NOWAIT swiotlb_alloc_tlb() in swiotlb_find_slots() uses dma_alloc_from_pool() and CONFIG_DMA_DIRECT_REMAP makes that vaddr differ from phys_to_virt(); filling io_tlb_default_mem then unmapping is attacker-driven I/O with no race.\nPR:L - No capability check gates dma_map_page_attrs() or swiotlb_tbl_map_single(). An unprivileged user triggers the GFP_NOWAIT transient pool by ordinary I/O, e.g. virtio-blk virtqueue_add_sgs() \u2192 virtqueue_map_page_attrs(), or sendmsg on virtio-net, which bounce through SWIOTLB_FORCE on a CCA guest.\nUI:N - The attacker\u2019s own map/unmap I/O allocates the transient pool and later dma_direct_unmap_phys() \u2192 __swiotlb_tbl_unmap_single() \u2192 swiotlb_del_transient() \u2192 swiotlb_dyn_free() \u2192 swiotlb_free_tlb(); no victim mount or other action is required.\nS:U - pool-\u003estart remains page_to_phys(tlb), so the device still DMAs to the allocated bounce pages. The defect is swiotlb_free_tlb() passing the linear phys_to_virt address into dma_free_from_pool()/__free_pages, corrupting the guest page allocator, not an IOMMU map of foreign pages or a realm/host escape.\nC:H - When dma_free_from_pool() rejects the linear address, swiotlb_free_tlb() still __free_pages()s those atomic-pool frames while gen_pool still owns them and dma_common_contiguous_remap() leaves a decrypted VM_DMA_COHERENT alias, so the pages can be reallocated with a stale kernel mapping.\nI:H - atomic_pool_expand() allocated one high-order compound page that gen_pool carved up; __free_pages(virt_to_page(linear_vaddr), get_order(tlb_size)) is a wrong-order or tail-page free of that block, corrupting buddy metadata and yielding an arbitrary write primitive.\nA:H - The same __free_pages() of a compound tail page or the wrong order produces bad-page handling, VM_BUG, or an oops, and any leftover coherent remap or reused frame later panics when touched."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:01.310Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68bf3ebd8e7020dae58e8aa14c7d482738bff9a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/45507dcb0847e96add4455274b12df0eca6590b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/35e0103177826430b5df888b1506239d41e76ab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319"
        },
        {
          "url": "https://git.kernel.org/stable/c/57d29044d0f29a76c6ec0c112c8c7371d5608dc7"
        }
      ],
      "title": "swiotlb: Preserve allocation virtual address for dynamic pools",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90387",
    "datePublished": "2026-09-17T16:09:22.493Z",
    "dateReserved": "2026-09-11T19:38:34.809Z",
    "dateUpdated": "2026-09-18T17:55:01.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90387",
      "date": "2026-09-29",
      "epss": "0.00175",
      "percentile": "0.06275"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:46:14.000Z",
      "cve": "CVE-2026-90387",
      "id": "msrc_CVE-2026-90387",
      "initial_release_date": "2026-09-19T01:03:49.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "swiotlb: Preserve allocation virtual address for dynamic pools",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90387.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/dma/swiotlb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "68bf3ebd8e7020dae58e8aa14c7d482738bff9a8",
                    "status": "affected",
                    "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45507dcb0847e96add4455274b12df0eca6590b4",
                    "status": "affected",
                    "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35e0103177826430b5df888b1506239d41e76ab5",
                    "status": "affected",
                    "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319",
                    "status": "affected",
                    "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57d29044d0f29a76c6ec0c112c8c7371d5608dc7",
                    "status": "affected",
                    "version": "79636caad3618e2b38457f6e298c9b31ba82b489",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/dma/swiotlb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: Preserve allocation virtual address for dynamic pools\n\nswiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted\npool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the\natomic pool is backed by remapped virtual addresses, which are not the same\nas the direct-map addresses returned by phys_to_virt().\n\nswiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address\nfrom the physical start address. For atomic-pool backed allocations this\nstores the wrong address in pool-\u003evaddr. Later, swiotlb_free_tlb() passes\nthat address to dma_free_from_pool(), which will fail to recognize the\nchunk\n\nPass the virtual address returned by the allocation path into\nswiotlb_init_io_tlb_pool(), and store that address in pool-\u003evaddr. This\nkeeps the pool free path using the same virtual address as the allocator."
          }
        ],
        "id": "CVE-2026-90387",
        "lastModified": "2026-09-18T18:17:56.617",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:38.140",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35e0103177826430b5df888b1506239d41e76ab5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45507dcb0847e96add4455274b12df0eca6590b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/57d29044d0f29a76c6ec0c112c8c7371d5608dc7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68bf3ebd8e7020dae58e8aa14c7d482738bff9a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c1f4d7763cdf1b9e0d35c14aa6f52d0512a36319"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:29:07Z",
      "cve": "CVE-2026-90387",
      "id": "CVE-2026-90387",
      "initial_release_date": "2026-09-18T00:17:05Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90387",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90387.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.