CVE-2026-98003

Source
https://cve.org/CVERecord?id=CVE-2026-98003
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98003.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-98003
Downstream
Published
2026-09-25T10:23:30Z
Modified
2026-09-26T03:48:31Z
Summary
iommu/amd: Do not reallocate GA log buffers on resume
Details

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Do not reallocate GA log buffers on resume

Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume.

iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline.

Return early if both buffers are already allocated. Clear the pointers in free_ga_log() so a partial allocation failure cannot leave ga_log dangling.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98003.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b
Fixed
94458b80d3b203c1c9e2c98aa7319b7713e006c0
Fixed
b6be275d19cee01f8f1f08a2ff18337103d05d40
Fixed
00a7dd64888d6dd72110b40e2824a088cf7b7386

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98003.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.7

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98003.json"