CVE-2026-90387

What it actually does

Incorrect virtual address reconstruction in swiotlb_init_io_tlb_pool() for atomic-pool backed allocations under CONFIG_DMA_DIRECT_REMAP stores a mismatched vaddr in pool->vaddr; subsequent swiotlb_free_tlb() passes the wrong address to dma_free_from_pool(), causing the free path to fail to recognize the chunk and resulting in memory management errors.

Why it matters to the business

Linux systems may experience kernel memory corruption, crashes, or denial of service; local attackers could potentially leverage the flaw for privilege escalation, affecting server stability and requiring urgent patching to maintain operational integrity.

How an attack unfolds

An attacker with local user access triggers swiotlb_alloc_tlb() to allocate from the DMA atomic pool in atomic context requiring a decrypted pool; the pool initialization stores an incorrect virtual address derived from phys_to_virt(), so later free operations using that address fail to match the allocation, enabling memory corruption primitives.

How to fix it

Apply the upstream fix that passes the allocation-returned virtual address into swiotlb_init_io_tlb_pool() and stores it in pool->vaddr; update to a kernel containing the resolution for CVE-2026-90387.

How to confirm the fix worked

Confirm kernel source contains the corrected swiotlb_init_io_tlb_pool() call that receives and stores the allocation-provided virtual address; test allocation/free cycles under CONFIG_DMA_DIRECT_REMAP with atomic decrypted pools to verify no address mismatch occurs.

Typical attack path

1. Obtain local user privileges on a vulnerable Linux kernel
2. Trigger code paths that invoke swiotlb_alloc_tlb() from atomic context needing a decrypted pool
3. Cause allocation to come from the remapped atomic DMA pool
4. Trigger corresponding free path that uses the incorrectly stored vaddr
5. Exploit resulting memory management failure for corruption or crash

How to detect it

Inspect kernel logs for swiotlb or dma_free_from_pool errors indicating unrecognized chunks; examine dmesg or syslog around allocation/free sequences involving atomic DMA pools; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all affected Linux distributions within standard maintenance windows
• Monitor upstream stable and distribution security feeds for the specific commit backports
• Restrict local unprivileged access where feasible until patches are deployed
• Review workloads that heavily exercise DMA atomic pools for early signs of instability