CVE-2026-89995 Overview
CVE-2026-89995 is a Linux kernel vulnerability in the direct memory access (DMA) subsystem. The flaw resides in dma_direct_alloc_from_pool(), which was refactored to return a CPU address instead of a struct page *. The change broke the contract expected by dma_direct_alloc_pages(), causing the caller to interpret a CPU virtual address as a page structure pointer. This type confusion can lead to memory corruption and undefined kernel behavior when DMA buffers are allocated from the atomic pool.
Critical Impact
The type confusion in dma_direct_alloc_from_pool() can corrupt kernel memory, enabling denial of service or potential privilege escalation on affected Linux kernels.
Affected Products
- Linux kernel versions containing commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper")
- Kernel builds that route DMA allocations through dma_direct_alloc_pages()
- Architectures relying on the DMA atomic pool for coherent allocations
Discovery Timeline
- 2026-09-16 - CVE-2026-89995 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89995
Vulnerability Analysis
The Linux kernel exposes dma_direct_alloc_from_pool() as a helper for coherent DMA buffer allocation from the atomic pool. Commit 5b138c534fda refactored the helper so that it returned the CPU virtual address obtained from dma_alloc_from_pool(). This return-type change matched the expectations of dma_direct_alloc(), but broke dma_direct_alloc_pages(), which expects a struct page *. The caller then treats a raw CPU address as a page descriptor pointer, leading to invalid memory dereferences inside the kernel.
The upstream fix restores the original return contract. The helper now returns a struct page * and passes the CPU address back to dma_direct_alloc() via an out-parameter. This preserves the original behavior for both call sites and eliminates the type confusion.
Root Cause
The root cause is a return-type mismatch introduced during helper factoring. dma_direct_alloc_from_pool() was modified to serve one caller correctly while silently breaking another. Because both call sites compile without warnings when handling pointer-typed values, the defect only manifests at runtime when the page pointer is dereferenced or arithmetic is performed on it.
Attack Vector
The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates an adjacent-network attack surface with no privileges or user interaction required. An attacker with the ability to trigger DMA allocations through the affected code path — for example, via a driver reachable from a peripheral or a network-facing subsystem on the same broadcast domain — can induce the corrupted allocation flow. Successful exploitation can crash the kernel or corrupt adjacent memory used by drivers.
No verified proof-of-concept code is publicly available. Refer to the upstream fix commits for technical detail: Kernel Git Commit 408ff2d, Kernel Git Commit 94a04ad, Kernel Git Commit c3fdb94, and Kernel Git Commit feeb2ef.
Detection Methods for CVE-2026-89995
Indicators of Compromise
- Kernel panics or Oops messages referencing dma_direct_alloc_pages or dma_direct_alloc_from_pool in stack traces
- Slab corruption warnings and general protection faults originating from DMA allocation paths
- Driver initialization failures on subsystems that request coherent DMA buffers from the atomic pool
Detection Strategies
- Inventory running kernels and identify builds that include commit 5b138c534fda but lack the fix commits listed in the references
- Enable KASAN and SLUB_DEBUG in test kernels to surface invalid memory accesses in DMA code paths
- Correlate host telemetry with driver reload events and DMA-related kernel warnings
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a centralized log platform for pattern matching on DMA subsystem faults
- Alert on repeated kernel crashes localized to devices that exercise the atomic DMA pool
- Track kernel package versions across the fleet and flag hosts pinned to unpatched stable branches
How to Mitigate CVE-2026-89995
Immediate Actions Required
- Apply the upstream stable kernel updates that include the fix commits 408ff2d, 94a04ad, c3fdb94, and feeb2ef
- Reboot systems after upgrading to ensure the patched kernel image is active
- Prioritize hosts that expose DMA-capable drivers to adjacent-network peripherals or accelerators
Patch Information
The vulnerability is resolved by restoring the original return type of dma_direct_alloc_from_pool() to struct page * and returning the CPU address through an out-parameter for the dma_direct_alloc() caller. Patched sources are available via the kernel.org stable tree in the referenced commits.
Workarounds
- No supported configuration workaround exists; the defect is in core DMA allocation logic
- Restrict physical and adjacent-network access to peripherals capable of driving affected DMA paths until patches are deployed
- Disable or unload non-essential drivers that allocate from the atomic DMA pool where operationally feasible
# Verify running kernel version and confirm patched build
uname -r
# Debian/Ubuntu: install the latest stable kernel
sudo apt update && sudo apt install --only-upgrade linux-image-generic
# RHEL/Rocky/Alma: update kernel package
sudo dnf update kernel
# Reboot to activate the patched kernel
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
