CVE-2026-98298
Description
A flaw was found in the Linux kernel's MMP Peripheral Direct Memory Access (PDMA) driver. When preparing multi-entry scatter-gather lists for Direct Memory Access (DMA) transfers, the driver incorrectly reads the buffer length from the initial list entry rather than the active entry being processed. A local user could exploit this flaw to trigger out-of-bounds memory reads, leading to system crashes or potential information disclosure, or cause silent data loss during DMA operations.
Statement
mmp_pdma uses the DMA length of the first scatterlist entry while processing every later entry. A later entry that is shorter than the first can therefore produce a DMA descriptor that extends beyond the mapped segment, causing an out-of-bounds DMA read and potentially an out-of-bounds write for a device-to-memory transfer. A later entry that is longer than the first can instead cause silent data loss because only part of the segment is transferred. For the CVSS the PR:L value reflects that a local process may reach the vulnerable DMA path through an accessible client device interface, although reliable triggering depends on the client driver, device permissions, MMP PDMA hardware, and a multi-entry scatterlist with unequal lengths. The issue is not directly network reachable. Impact includes possible information exposure to a DMA device, data corruption, transfer failure, IOMMU faults, or a kernel crash.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
