Executive brief
The Linux kernel's SWIOTLB (Software I/O TLB) subsystem manages DMA memory buffers for I/O operations. A bug causes incorrect virtual addresses to be stored when allocating from encrypted DMA pools on systems with CONFIG_DMA_DIRECT_REMAP enabled, leading to memory leaks and potential system instability when the kernel attempts to free these buffers.
Technical details
The vulnerability is a memory address mismatch in the SWIOTLB dynamic pool allocation path. When swiotlb_alloc_tlb() allocates from the DMA atomic pool for encrypted memory in atomic context, it returns a remapped virtual address that differs from the direct-map address produced by phys_to_virt(). However, swiotlb_init_io_tlb_pool() was reconstructing the virtual address directly from the physical address, storing an incorrect address in pool->vaddr. When swiotlb_free_tlb() later attempts to free the buffer using the wrong address, dma_free_from_pool() fails to recognize the chunk, causing a resource leak and potential system corruption. The fix passes the correct virtual address from the allocator through to the pool initialization, ensuring consistency between allocation and free operations. The vulnerability affects systems with CONFIG_DMA_DIRECT_REMAP enabled that use encrypted DMA pools.
Affected products
- Linux Linux kernel All versions with CONFIG_DMA_DIRECT_REMAP and SWIOTLB dynamic pools enabled
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix available via stable kernel commit 35e0103177826430b5df888b1506239d41e76ab5