CVE-2026-98298

What it actually does

Incorrect use of scatterlist head instead of current entry when computing DMA length in mmp_pdma_prep_slave_sg causes out-of-bounds reads on shorter subsequent segments and silent truncation on longer ones.

Why it matters to the business

Kernel DMA operations on multi-segment buffers may corrupt memory or drop data, leading to crashes, device malfunction, or unreliable I/O on affected systems.

How an attack unfolds

An attacker crafts or influences a scatter-gather list with varying entry lengths passed to the mmp_pdma driver; the loop repeatedly reads the first entry's length, resulting in reads or writes beyond intended buffers.

How to fix it

Apply the upstream fix that changes sg_dma_len(sgl) to sg_dma_len(sg) inside the for_each_sg loop; rebuild and deploy the corrected kernel.

How to confirm the fix worked

Inspect the mmp_pdma.c source for the corrected sg_dma_len argument; boot the updated kernel and exercise multi-segment DMA transfers to confirm absence of prior symptoms.

Typical attack path

1. Identify or trigger code paths that invoke mmp_pdma_prep_slave_sg with a multi-entry scatterlist
2. Supply entries whose lengths differ from the first entry
3. Observe resulting out-of-bounds memory access or truncated DMA transfer

How to detect it

Review kernel logs for DMA-related oops or warnings during scatter-gather operations; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel update on systems using the mmp_pdma controller
• Monitor for related patches in distribution security feeds
• Audit any custom DMA-using drivers for similar scatterlist handling errors