CVE-2026-98242: dma-buf: Fix silent overflow for phys vec to sgt
In the Linux kernel, the following vulnerability has been resolved:
dma-buf: Fix silent overflow for phys vec to sgt
In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mappedlen.
Previously, mappedlen was declared as 32-bit unsigned int. When accumulating sizet lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like fillsgentry().
Fix this by changing mappedlen to sizet (64-bit). While at it, fix similar potential overflow issues in calcsgnents by using checkaddoverflow() for nents and using unsigned int for the loop iterator in fillsgentry to match.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Change mapped_len from 32-bit unsigned int to size_t (64-bit).
Linux kernel dma-buf phys vec to sgt mapped_len = size_t (64-bit) - Configuration
Use check_add_overflow() when accumulating nents in calc_sg_nents.
Linux kernel dma-buf phys vec to sgt calc_sg_nents nents accumulation = check_add_overflow() - Configuration
Use unsigned int for the loop iterator in fill_sg_entry.
Linux kernel dma-buf phys vec to sgt fill_sg_entry loop iterator = unsigned int
Event History
Frequently Asked Questions
Which systems are exposed to this overflow condition?
The affected path requires peer-to-peer DMA to traverse a host bridge and an MMIO size greater than 4 GB. Systems that do not use this DMA configuration are not described as reaching the vulnerable condition.
What happens when the vulnerable path is triggered?
The total linked IOVA can exceed 4 GB, but it was stored in a 32-bit mapped_len value. The resulting silent wrap-around can pass truncated lengths to functions such as fill_sg_entry().
What is the remediation?
Apply a kernel version containing the referenced fixes. The correction changes mapped_len to size_t and adds overflow checking for scatter-gather entry calculations.