CVE-2026-98254

A flaw was found in the Linux kernel's Software I/O Translation Lookaside Buffer (swiotlb). During Direct Memory Access (DMA) bounce operations involving high memory, an incorrect address calculation occurs when an offset crosses a page boundary. This error causes data transfers to read from or overwrite unintended memory pages instead of the targeted buffer. Consequently, this flaw can lead to memory corruption, data leakage, or a denial of service via a system crash.

A page calculation error in swiotlb_bounce can combine the page frame from the original DMA address with the offset from the adjusted address. When a partial DMA synchronization uses a nonzero tlb_offset and crosses a page boundary, DMA_FROM_DEVICE can overwrite the wrong highmem page while DMA_TO_DEVICE can expose data from a page outside the intended mapping to the device. This is a concrete wrong page read and write primitive with potential memory corruption rather than a warning only condition. For the CVSS the PR:L is selected because a local user or process must access an affected device interface and initiate driver operations that reach the partial DMA synchronization path. AC:H reflects the required SWIOTLB and highmem configuration, a suitable driver path, and a range adjustment that crosses a page boundary. The issue is not classified as directly network reachable because the generic SWIOTLB code does not establish a remote trigger without a specific network driver path. Impact is at least denial of service and limited confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.