Executive brief
The Linux kernel's NTB (Non-Transparent Bridge) transport driver was incorrectly modifying DMA memory addresses before releasing allocated memory. This violates DMA API requirements and could cause memory corruption or system instability when DMA-mapped buffers are freed. The issue affects systems using NTB hardware bridges for inter-processor communication.
Technical details
The vulnerability is a DMA API misuse in the NTB transport driver (drivers/ntb/ntb_transport.c). The code was passing a modified DMA address to dma_free_coherent() instead of the original address returned by the allocation function, violating the DMA API contract that requires the exact handle to be used for deallocation. The fix stores the original DMA address in a new struct field (original_dma_addr) and uses it during cleanup. This is a correctness/resource management issue rather than a security vulnerability; the impact is kernel memory corruption during DMA buffer lifecycle management.
Affected products
- Linux Linux kernel multiple versions (see commit history)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-05-01: patched: Patch authored by Leon Romanovsky
- 2026-07-24: patched: Merged into stable kernel by Greg Kroah-Hartman