CVE-2026-89995

A refactoring bug in the Linux kernel's dma-direct subsystem left dma_direct_alloc_from_pool() returning a CPU (virtual) address instead of a struct page pointer, while one of its callers, dma_direct_alloc_pages(), still expects and uses a struct page * — a classic type-confusion that corrupts kernel memory when hit. The flaw is triggered when a DMA allocation falls back to the coherent/atomic memory pool, for example under memory pressure or on systems with constrained DMA addressing. An attacker able to reach the vulnerable allocation path (scored as requiring adjacent-network access, e.g. via a driver-facing code path, with no privileges or user interaction) could achieve kernel memory corruption leading to information disclosure, privilege escalation, or a system crash (CVSS 3.1: 8.8 High). Any Linux system running a kernel built from code containing commit 5b138c534fda, which factored out the dma_direct_alloc_from_pool() helper, is potentially affected until a kernel containing the fix. Exploitation status is currently clean: no public proof-of-concept, no known in-the-wild exploitation, and the flaw is not in CISA's KEV catalog.

What to do: Update Linux kernels to releases that include the fix (which restores struct page * returns from dma_direct_alloc_from_pool() and passes the CPU address via an out-parameter) as they appear in mainline, stable, and vendor/distro security advisories. Until patched, limit untrusted local code execution and treat devices with exposed driver/kernel attack surfaces as higher risk. Verify your kernel includes commit 5b138c534fda to determine whether your build is in scope.