KernelScan.io

HIGH

tracing DMA Buffer Overflow

CVE-2026-23390

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI7.8HIGH

01

In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow The dma_map_sg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices like virtio-gpu creating large DRM buffers, nents can exceed 1000 entries, resulting in: phys_addrs: 1000 * 8 bytes = 8,000 bytes dma_addrs: 1000 * 8 bytes = 8,000 bytes lengths: 1000 * 4 bytes = 4,000 bytes Total: ~20,000 bytes This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing: WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405 perf buffer not large enough, wanted 24620, have 8192 Cap all three dynamic arrays at 128 entries using min() in the array size calculation. This ensures arrays are only as large as needed (up to the cap), avoiding unnecessary memory allocation for small operations while preventing overflow for large ones. The tracepoint now records the full nents/ents counts and a truncated flag so users can see when data has been capped. Changes in v2: - Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from Steven Rostedt) - This allocates only what's needed up to the cap, avoiding waste for small operations Reviwed-by: Sean Anderson <sean.anderson@linux.dev>

02

Engine v0.2.0

Risk summary

A buffer overflow in DMA tracing can cause kernel warnings and potentially system instability when applications perform large DMA operations. While not directly exploitable for privilege escalation, it can lead to denial of service through kernel crashes or resource exhaustion in systems with DMA tracing enabled.

Affectedinclude/trace/events/dma.h

Vulnerability analysis

Root Cause: The dma_map_sg tracepoint allocates dynamic arrays based on the number of scatter-gather entries (nents) without bounds checking. When devices like virtio-gpu create large DRM buffers with over 1000 entries, the total array size can exceed 20KB, surpassing the PERF_MAX_TRACE_SIZE limit of 8192 bytes.

Attack Surface: This vulnerability affects systems using DMA tracing with perf events. It requires local access to trigger DMA operations with large scatter-gather lists, typically through graphics drivers or other DMA-intensive subsystems. The overflow occurs in kernel tracing infrastructure when processing legitimate DMA operations.

Fix Mechanism: The patch introduces DMA_TRACE_MAX_ENTRIES (128) as a cap for dynamic array allocation. It uses min(nents, DMA_TRACE_MAX_ENTRIES) to limit array sizes while preserving the original counts in separate fields. A truncated flag indicates when data has been capped, maintaining observability.

03

BranchFixed inPatch commit
6.126.12.7402d209bb018a
6.186.18.13f2584f791a10
mainline6.19daafcc0ef0b3