CVE-2026-74277
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel IOMMU DMA subsystem, the P2PDMA path incorrectly assigned the DMA length from the head segment instead of the current segment, corrupting lengths for multi-segment scatterlists.
Risk Assessment
Incorrect DMA lengths can lead to data transfer errors or system crashes when P2PDMA is used.
Recommendation
Apply the Linux kernel update that uses s->length instead of sg->length.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`. This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists. Fix this by using `s->length` instead of `sg->length`.