CVE-2026-98298

A flaw was found in the Linux kernel's MMP Peripheral Direct Memory Access (PDMA) driver. When preparing multi-entry scatter-gather lists for Direct Memory Access (DMA) transfers, the driver incorrectly reads the buffer length from the initial list entry rather than the active entry being processed. A local user could exploit this flaw to trigger out-of-bounds memory reads, leading to system crashes or potential information disclosure, or cause silent data loss during DMA operations.

mmp_pdma uses the DMA length of the first scatterlist entry while processing every later entry. A later entry that is shorter than the first can therefore produce a DMA descriptor that extends beyond the mapped segment, causing an out-of-bounds DMA read and potentially an out-of-bounds write for a device-to-memory transfer. A later entry that is longer than the first can instead cause silent data loss because only part of the segment is transferred. For the CVSS the PR:L value reflects that a local process may reach the vulnerable DMA path through an accessible client device interface, although reliable triggering depends on the client driver, device permissions, MMP PDMA hardware, and a multi-entry scatterlist with unequal lengths. The issue is not directly network reachable. Impact includes possible information exposure to a DMA device, data corruption, transfer failure, IOMMU faults, or a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.