CVE-2026-98298
Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.
How to fix
- Linux Linuxf448a5f5bd10d792440a1b08cf2e8f311767032d, 2148db529f082d6e3ca95413bf943442f4ef30cc, d920c07aa6d89ec11afdb6976aafaee9563a5234, 4a33886057e6d127555efb022879c583e966acc5, 88a505330eb06128f7ce79a4c5e4832b7601b3d1, bae65e4925928f77824ca0103122e2ed20ef5802, 54ccc01012a240476edf641bf1a2b8bff54fe6ae, 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < f448a5f5bd10d792440a1b08cf2e8f311767032d, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < 2148db529f082d6e3ca95413bf943442f4ef30cc, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < d920c07aa6d89ec11afdb6976aafaee9563a5234, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < 4a33886057e6d127555efb022879c583e966acc5, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < 88a505330eb06128f7ce79a4c5e4832b7601b3d1, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < bae65e4925928f77824ca0103122e2ed20ef5802, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < 54ccc01012a240476edf641bf1a2b8bff54fe6ae, c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 ≤ v < 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47, 3.7 | f448a5f5bd10d792440a1b08cf2e8f311767032d, 2148db529f082d6e3ca95413bf943442f4ef30cc, d920c07aa6d89ec11afdb6976aafaee9563a5234, 4a33886057e6d127555efb022879c583e966acc5, 88a505330eb06128f7ce79a4c5e4832b7601b3d1, bae65e4925928f77824ca0103122e2ed20ef5802, 54ccc01012a240476edf641bf1a2b8bff54fe6ae, 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.