Executive brief
A bug in the Linux kernel's direct DMA memory allocation subsystem caused a function to return the wrong data type, breaking memory allocation for some DMA operations. This type mismatch could lead to memory corruption, system crashes, or unexpected behavior in any kernel subsystem or driver that relies on direct DMA memory allocation, particularly those requiring encryption or non-blocking allocation paths.
Technical details
A regression in commit 5b138c534fda caused dma_direct_alloc_from_pool() to return a CPU address (void *) instead of a struct page *, which is required by the dma_direct_alloc_pages() caller. The function signature was changed to return CPU address, but dma_direct_alloc_pages() expects a page structure for proper memory management. The fix restores the function to return struct page * and uses an out-parameter to pass the CPU address to callers that need it. This affects memory allocation under GFP_ATOMIC or when forced DMA encryption is enabled. The vulnerability does not require network access, authentication, or user interaction—it is triggered during normal kernel DMA memory allocation operations.
Affected products
- Linux Linux kernel All versions containing commit 5b138c534fda up to the fix
Timeline
- 2026-09-16: disclosed
- 2026-07-31: patched: Fix committed upstream; stable backport released 2026-09-11