CVE-2026-90387 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux system administrators, security teams responsible for Linux kernel patch deployment, and operators of Linux kernel systems should assess exposure and verify patch deployment for the swiotlb vulnerability. They should also review Linux kernel patch deployment, verify system exposure, and update the Linux kernel to the latest version if necessary. Vulnerability management and security teams should prioritize patch deployment,

Why it matters

A vulnerability in the Linux kernel's swiotlb has been resolved, and Linux kernel maintainers and users should assess exposure and verify patch deployment.

• Verify patch deployment for swiotlb vulnerability
• Assess exposure of Linux kernel systems to CVE-2026-90387
• Update Linux kernel to latest version if necessary

Technical summary

The swiotlb_alloc_tlb() function can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. However, swiotlb_init_io_tlb_pool() reconstructs the pool virtual address from the physical start address, which can store the wrong address in pool->vaddr for atomic-pool backed allocations. This can cause issues when swiotlb_free_tlb() passes that address to dma_free_from_pool(). Linux kernel maintainers and users should assess exposure and verify patch deployment. The vulnerability has been resolved in the Linux kernel.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch deployment.

Recommended defensive actions

• Review Linux kernel patch deployment for swiotlb vulnerability
• Verify system exposure to CVE-2026-90387
• Update Linux kernel to latest version if necessary
• Assess exposure of Linux kernel systems to CVE-2026-90387
• Verify patch deployment for swiotlb vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Linux kernel's swiotlb, but the scope of affected systems and versions is not explicitly stated. Linux kernel maintainers and users should verify patch deployment and assess exposure. Defensive verification tasks include reviewing Linux kernel patch deployment, verifying system exposure, and updating the Linux kernel to the latest version if necessary. The swiotlb_alloc_tlb() function can allocate from the DMA atomic pool when a decrypted pool is needed from an

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.