All vulnerabilities
CVE-2026-98298

Linux: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2148db529f082d6e3ca95413bf943442f4ef30ccAlso 4a33886057e6d127555efb022879c583e966acc5, 88a505330eb06128f7ce79a4c5e4832b7601b3d1 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2148db529f082d6e3ca95413bf943442f4ef30ccLinuxCVE List
  • 4a33886057e6d127555efb022879c583e966acc5LinuxCVE List
  • 88a505330eb06128f7ce79a4c5e4832b7601b3d1LinuxCVE List
  • 54ccc01012a240476edf641bf1a2b8bff54fe6aeLinuxCVE List
  • 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry):

for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */

Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.

Text from CVE List

Affected versions 18

  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before f448a5f5bd10d792440a1b08cf2e8f311767032dCVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before 2148db529f082d6e3ca95413bf943442f4ef30ccCVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before d920c07aa6d89ec11afdb6976aafaee9563a5234CVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before 4a33886057e6d127555efb022879c583e966acc5CVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before 88a505330eb06128f7ce79a4c5e4832b7601b3d1CVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before bae65e4925928f77824ca0103122e2ed20ef5802CVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before 54ccc01012a240476edf641bf1a2b8bff54fe6aeCVE List
  • Linuxaffected: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 before 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47CVE List
  • Linuxaffected: 3.7CVE List
  • Linuxunaffected: all versions before 3.7CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8