CVE-2026-90388
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. Do not rely on cpu_addr to detect allocation failure in this path. Check the returned page directly before using it for the IOMMU mapping.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-17 17:17:38.287000
Last modified
2026-10-19 09:19:32.843000
View original CVE JSON
{
"id": "CVE-2026-90388",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-17T17:17:38.287",
"lastModified": "2026-10-19T09:19:32.843",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/dma: Check atomic pool allocation result directly\n\nThe non-blocking, non-coherent allocation path uses dma_alloc_from_pool(),\nwhich returns the allocated page and fills cpu_addr only on success.\n\nDo not rely on cpu_addr to detect allocation failure in this path. Check\nthe returned page directly before using it for the IOMMU mapping."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/iommu/dma-iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "ac9cd0a669b8be5d178dbd471b0d68039dac58b5",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "db46cb9da83a507d86d2bb080bdb09c865da3d0a",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "d56c3f955b21e5764c1497e295a5b5d0b3a40470",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "06dffc96693083dda3412311406e558cf27f1574",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "a4ace31d732b657d774e31fb444c0c27d42c78e5",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "fb0b39287ba894dbdfac2901c51788b63f5c2291",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "8c486293ddd0af60991408149fc3e964ea888dc4",
"versionType": "git",
"status": "affected"
},
{
"version": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"lessThan": "af95a0ebc0a0db0762be75f51eadf770bad01aaa",
"versionType": "git",
"status": "affected"
},
{
"version": "47184b9ddf184cc9a77cf441943a0fe9b7afa575",
"versionType": "git",
"status": "affected"
},
{
"version": "5.8.6",
"lessThan": "5.9",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/iommu/dma-iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.9",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.9",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.270",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.110",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.52",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.6",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06dffc96693083dda3412311406e558cf27f1574",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8c486293ddd0af60991408149fc3e964ea888dc4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4ace31d732b657d774e31fb444c0c27d42c78e5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ac9cd0a669b8be5d178dbd471b0d68039dac58b5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/af95a0ebc0a0db0762be75f51eadf770bad01aaa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d56c3f955b21e5764c1497e295a5b5d0b3a40470",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db46cb9da83a507d86d2bb080bdb09c865da3d0a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fb0b39287ba894dbdfac2901c51788b63f5c2291",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}