CVE-2026-89995: dma-direct: return struct page from dma_direct_alloc_from_pool()
In the Linux kernel, the following vulnerability has been resolved:
dma-direct: return struct page from dmadirectallocfrompool()
Commit 5b138c534fda ("dma-direct: factor out a dmadirectallocfrompool helper") changed dmadirectallocfrompool() to return the CPU address from dmaallocfrompool(). That fits dmadirectalloc(), but dmadirectallocpages() also uses the helper and expects a struct page .
Fix this by making dmadirectallocfrompool() return the struct page again, and pass the CPU address back through an out-parameter for the dmadirectalloc() caller.
Event History
Frequently Asked Questions
Which allocation path is affected by this defect?
The issue affects dma_direct_alloc_pages(), which uses dma_direct_alloc_from_pool() and expects that helper to return a struct page pointer. The regressed helper instead returned a CPU address.
What change resolves the issue?
The fix restores dma_direct_alloc_from_pool() returning a struct page pointer and passes the CPU address to dma_direct_alloc() through an output parameter.