dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.271, 5.15.222, 6.1.189, 6.12.112, 6.18.54, 6.6.158, 7.2.8
- CVEs
- CVE-2026-98298
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:39 UTC · Revision 1
Source evidence
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
core-osv · Original sourcePublished 6 Oct 2026, 08:45 UTC
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.
osv:CVE-2026-98298
Kernel
Fixed versions: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8
Complete source record
{
"id": "d94e45f0f82ba4d9042885ef021d4d13c92501dab7e4bda7e5d16f8fac1d1c24",
"url": "https://osv.dev/vulnerability/CVE-2026-98298",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.",
"evidence": "osv:CVE-2026-98298",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.271",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.222",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.189",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.158",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.112",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.54",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-98298",
"aliases": [
"CVE-2026-98298"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2"
},
{
"fixed": "f448a5f5bd10d792440a1b08cf2e8f311767032d"
},
{
"fixed": "2148db529f082d6e3ca95413bf943442f4ef30cc"
},
{
"fixed": "d920c07aa6d89ec11afdb6976aafaee9563a5234"
},
{
"fixed": "4a33886057e6d127555efb022879c583e966acc5"
},
{
"fixed": "88a505330eb06128f7ce79a4c5e4832b7601b3d1"
},
{
"fixed": "bae65e4925928f77824ca0103122e2ed20ef5802"
},
{
"fixed": "54ccc01012a240476edf641bf1a2b8bff54fe6ae"
},
{
"fixed": "075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98298.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.7.0"
},
{
"fixed": "5.10.271"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.222"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.189"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.158"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.112"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.54"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.8"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98298.json"
}
}
],
"modified": "2026-10-28T02:30:26.622128089Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47",
"https://git.kernel.org/stable/c/2148db529f082d6e3ca95413bf943442f4ef30cc",
"https://git.kernel.org/stable/c/4a33886057e6d127555efb022879c583e966acc5",
"https://git.kernel.org/stable/c/54ccc01012a240476edf641bf1a2b8bff54fe6ae",
"https://git.kernel.org/stable/c/88a505330eb06128f7ce79a4c5e4832b7601b3d1",
"https://git.kernel.org/stable/c/bae65e4925928f77824ca0103122e2ed20ef5802",
"https://git.kernel.org/stable/c/d920c07aa6d89ec11afdb6976aafaee9563a5234",
"https://git.kernel.org/stable/c/f448a5f5bd10d792440a1b08cf2e8f311767032d",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98298.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-98298",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98298.json"
}
},
"related_cves": [
{
"value": "CVE-2026-98298",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 493444,
"published_at": "2026-10-06T08:45:56.417+00:00"
}