Executive brief
The Linux kernel's IOMMU DMA allocation code contains a logic error that can lead to a null pointer dereference. When allocating non-blocking, non-coherent DMA memory, the code fails to properly check whether the memory allocation succeeded before attempting to use the result, potentially causing kernel crashes and denial of service.
Technical details
The vulnerability exists in drivers/iommu/dma-iommu.c in the iommu_dma_alloc() function. The non-blocking, non-coherent memory allocation path uses dma_alloc_from_pool(), which returns a page pointer and fills cpu_addr only on success. The buggy code relied on checking cpu_addr to detect allocation failure but proceeded to use the returned page without validating it, resulting in a null pointer dereference when dma_alloc_from_pool() fails. The fix adds an explicit check of the returned page pointer before using it for IOMMU mapping. No authentication is required; the vulnerability is triggered during normal kernel memory allocation operations on systems with IOMMU and DMA_DIRECT_REMAP enabled.
Affected products
- Linux Linux Kernel Affects multiple kernel versions from 2.6.x through 7.x (see git.kernel.org stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90388 published
- 2026-07-17: patched: Upstream fix committed (af95a0ebc0a0db0762be75f51eadf770bad01aaa)
- 2026-09-14: other: Backported to stable branches