UBUNTU-CVE-2026-98242: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mappedlen. Previously, mappedlen was declared as 32-bit unsigned int. When accumulating sizet lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like fillsgentry(). Fix this by changing mappedlen to sizet (64-bit). While at it, fix similar potential overflow issues in calcsgnents by using checkaddoverflow() for nents and using unsigned int for the loop iterator in fillsgentry to match.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Change mapped_len from 32-bit unsigned int to size_t (64-bit) to prevent truncation of linked IOVA lengths greater than 4G.
Linux kernel dma-buf phys vec to sgt mapped_len = size_t (64-bit) - Configuration
Use check_add_overflow() when accumulating nents in calc_sg_nents, and use an unsigned int loop iterator in fill_sg_entry.
Linux kernel dma-buf phys vec to sgt calc_sg_nents and fill_sg_entry arithmetic = check_add_overflow() for nents; unsigned int loop iterator
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The vulnerable path requires peer-to-peer DMA through a host bridge with an MMIO size greater than 4 GB.
What conditions cause the faulty behavior?
The issue occurs when the total linked IOVA exceeds 4 GB and is assigned to the 32-bit mapped_len variable. Accumulating size_t lengths can then silently wrap the value and pass truncated lengths to functions such as fill_sg_entry().
What does the fix change?
The fix changes mapped_len from unsigned int to size_t so it can hold the larger length. It also adds checked addition for nents in calc_sg_nents and changes the fill_sg_entry loop iterator to unsigned int.