CVE-2026-89995

A flaw was found in the Linux kernel's Direct Memory Access (DMA) subsystem. A local user can cause a Denial of Service (DoS) or potential memory corruption by interacting with affected device drivers. This issue occurs because an internal allocation helper function returns a virtual memory address instead of an expected page data structure pointer, resulting in type confusion. Consequently, subsequent memory operations reference an invalid structure, which can destabilize and crash the system.

dma_direct_alloc_from_pool returned a CPU address from the coherent DMA pool even though dma_direct_alloc_pages expected a struct page * from the same helper. This can make callers treat a DMA buffer virtual address as a struct page pointer, which is an invalid pointer type confusion in a core DMA allocation path. For the CVSS the PR:L is used for the paranoid score because a local user or service may be able to trigger affected driver allocation paths through an accessible device or workload without full administrator privileges. The issue is not directly network reachable from the patch context. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact if later page operations corrupt memory through the bogus struct page pointer. Exposure depends on CONFIG_DMA_COHERENT_POOL, force_dma_unencrypted, atomic pool allocation conditions, and a driver using dma_direct_alloc_pages on the affected path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.