In the Linux kernel, the following vulnerability has been resolved:

dmaengine: mmp pdma: fix wrong sg length in mmp pdma prep slave sg()

In mmp pdma prep slave sg(), for each sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry):

for each sg(sgl, sg, sg len, i) { addr = sg dma address(sg); avail = sg dma len(sgl); /* should be 'sg' */

Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.