CVE-2026-98242: Linux kernel · dma-buf: Fix silent overflow for phys vec to sgt
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to b344ca94e8cc85796f16ea25e2e5a8e0303fe813 or 6b98fd7106d4e486f432664893dcd4d6fa3a9693 when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in b344ca94e8cc85796f16ea25e2e5a8e0303fe813, 6b98fd7106d4e486f432664893dcd4d6fa3a9693
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to b344ca94e8cc85796f16ea25e2e5a8e0303fe813 or 6b98fd7106d4e486f432664893dcd4d6fa3a9693.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in Linux kernel versions identified by commits b344ca94e8cc85796f16ea25e2e5a8e0303fe813 and 6b98fd7106d4e486f432664893dcd4d6fa3a9693. Users should update to these fixed versions or later to remediate the vulnerability.
Description
A vulnerability in the Linux kernel's dma-buf subsystem caused a silent overflow due to a 32-bit variable truncating 64-bit length values when handling MMIO sizes larger than 4GB in peer-to-peer DMA scenarios. This overflow could lead to incorrect length calculations passed to internal functions. The issue has been fixed by changing the variable to 64-bit and adding overflow checks.