CVE-2026-89995

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89995
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89995.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89995
Downstream
Published
2026-09-16T10:33:07Z
Modified
2026-09-17T03:47:27Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
dma-direct: return struct page from dma_direct_alloc_from_pool()
Details

In the Linux kernel, the following vulnerability has been resolved:

dma-direct: return struct page from dma_direct_alloc_from_pool()

Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *.

Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89995.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5b138c534fda57c2ebc1e6de72578aa1d70788a6
Fixed
c3fdb94da43ff23287f85664174c45c45e881a3f
Fixed
408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8
Fixed
feeb2ef775081a6c188cdd10e7a45369a07ce531
Fixed
94a04ad732c9f8b9554270fc4038a06737de5c22

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89995.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.10.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.51
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89995.json"