7.8

CVE-2026-98254: swiotlb: use the adjusted address for the highmem page lookup

Received
AliasesUBUNTU-CVE-2026-98254DEBIAN-CVE-2026-98254
Published 06-10-2026Last modified 19-10-2026

Vulnerability summary

CVE-2026-98254 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.8% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.14%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12131-1

Timeline

  1. 06-10-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlb_bounce() reads the page frame number from the slot's recorded orig_addr, then advances orig_addr by tlb_offset to reach the address the caller asked about. The highmem branch mixes the two: the offset within the page comes from the adjusted address, the page from the value before it. Once the adjustment crosses a page boundary the pair no longer describes one location, and the whole copy lands one page below the intended one for a positive tlb_offset, one above for a negative one. DMA_FROM_DEVICE writes the device data over the wrong page and leaves the intended one stale, DMA_TO_DEVICE feeds the device from a page the mapping may not cover. Partial syncs through dma_sync_single_range_for_*() are what make tlb_offset non-zero. The branch test is picked the same way, so a slot recorded in lowmem can be adjusted into highmem and the lowmem path then hands a highmem address to phys_to_virt(). Take both from orig_addr once it is final and keep pfn in the branch that uses it. PhysHighMem() asks the question straight from the address, as dma-debug already does.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

06-10-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu158 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.12.113-1 | < 7.2.8-1
  • linux-6.12< 6.12.113-1~deb12u1
Linux1 product
  • linux≥ 5f89468e2f060031cd89fd4287298e0eaf246bf6, < 6e53b4d6afbde626255805d438cabb1cac482445 | ≥ 5f89468e2f060031cd89fd4287298e0eaf246bf6, < aa4709813b29db89f2307f968db5d24925dcdeb1 | ≥ 5f89468e2f060031cd89fd4287298e0eaf246bf6, < 0219b72f5c209732b2f03a8cc0d7240b5e428a99 | ≥ 5f89468e2f060031cd89fd4287298e0eaf246bf6, < b7d7914a9ae3097e63d113007e4fb44d33d515b1 | e6108147dd91b94d1979b110f265710c254c99d5 | e77b796eb9b7ca3c1c0d574d0c155f55b59ca8d5 | ≥ 5.10.47, < 5.11 | ≥ 5.12.14, < 5.13 | 5.13

3 vendors · 161 products

References

8 links