CVE-2026-90388
iommu/dma: Check atomic pool allocation result directly
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. Do not rely on cpu_addr to detect allocation failure in this path. Check the returned page directly before using it for the IOMMU mapping.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 18, 2026, 6:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Apply the patch to the Linux kernel.
- Verify the fix by testing DMA allocation.
- Ensure correct allocation checks are implemented.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90388.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90388 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90388
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90388 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90388 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 18, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. Do not rely on cpu_addr to detect allocation failure in this path. Check the returned page directly before using it for the IOMMU mapping. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90388.json">CVE-2026-90388</a> Added Reference https://git.kernel.org/stable/c/06dffc96693083dda3412311406e558cf27f1574 Added Reference https://git.kernel.org/stable/c/8c486293ddd0af60991408149fc3e964ea888dc4 Added Reference https://git.kernel.org/stable/c/a4ace31d732b657d774e31fb444c0c27d42c78e5 Added Reference https://git.kernel.org/stable/c/ac9cd0a669b8be5d178dbd471b0d68039dac58b5 Added Reference https://git.kernel.org/stable/c/af95a0ebc0a0db0762be75f51eadf770bad01aaa Added Reference https://git.kernel.org/stable/c/d56c3f955b21e5764c1497e295a5b5d0b3a40470 Added Reference https://git.kernel.org/stable/c/db46cb9da83a507d86d2bb080bdb09c865da3d0a Added Reference https://git.kernel.org/stable/c/fb0b39287ba894dbdfac2901c51788b63f5c2291