UBUNTU-CVE-2026-90387: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: swiotlb: Preserve allocation virtual address for dynamic pools swiotlballoctlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIGDMADIRECTREMAP, the atomic pool is backed by remapped virtual addresses, which are not the same as the direct-map addresses returned by phystovirt(). swiotlbinitiotlbpool() currently reconstructs the pool virtual address from the physical start address. For atomic-pool backed allocations this stores the wrong address in pool->vaddr. Later, swiotlbfreetlb() passes that address to dmafreefrompool(), which will fail to recognize the chunk Pass the virtual address returned by the allocation path into swiotlbinitiotlbpool(), and store that address in pool->vaddr. This keeps the pool free path using the same virtual address as the allocator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most likely to be affected?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop kernels. The issue specifically depends on CONFIG_DMA_DIRECT_REMAP and use of a decrypted SWIOTLB pool from atomic context that is backed by the DMA atomic pool.
What access does an attacker need to exploit this issue?
The supplied CVSS vector rates the attack vector as local and requires low privileges, with no user interaction. It does not describe a remote attack path.
What is the practical failure mode?
A dynamically allocated SWIOTLB pool can retain a reconstructed direct-map virtual address instead of the remapped address originally returned by allocation. When the pool is freed, dma_free_from_pool() may not recognize the chunk, producing a memory-management failure with high confidentiality, integrity, and availability impact according to the supplied severity vector.