CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly
In the Linux kernel, the following vulnerability has been resolved:
iommu/dma: Check atomic pool allocation result directly
The non-blocking, non-coherent allocation path uses dmaallocfrompool(), which returns the allocated page and fills cpuaddr only on success.
Do not rely on cpuaddr to detect allocation failure in this path. Check the returned page directly before using it for the IOMMU mapping.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path is the Linux kernel IOMMU DMA non-blocking, non-coherent allocation path. Systems that do not use this path are not identified as affected by the provided information.
What condition is required to trigger the flaw?
The issue requires dma_alloc_from_pool() to fail in the non-blocking, non-coherent allocation path. The vulnerable code can then rely on cpu_addr rather than checking the returned page before using it for IOMMU mapping.
How can I tell whether a kernel includes the fix?
Check whether the kernel source contains the change that tests the page returned by dma_alloc_from_pool() directly before using it for IOMMU mapping. The provided stable kernel references identify commits containing the resolution.