CVE-2026-98254

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: use the adjusted address for the highmem page lookup

swiotlb bounce() reads the page frame number from the slot's recorded orig addr, then advances orig addr by tlb offset to reach the address the caller asked about. The highmem branch mixes the two: the offset within the page comes from the adjusted address, the page from the value before it.

Once the adjustment crosses a page boundary the pair no longer describes one location, and the whole copy lands one page below the intended one for a positive tlb offset, one above for a negative one. DMA FROM DEVICE writes the device data over the wrong page and leaves the intended one stale, DMA TO DEVICE feeds the device from a page the mapping may not cover. Partial syncs through dma sync single range for *() are what make tlb offset non-zero.

The branch test is picked the same way, so a slot recorded in lowmem can be adjusted into highmem and the lowmem path then hands a highmem address to phys to virt().

Take both from orig addr once it is final and keep pfn in the branch that uses it. PhysHighMem() asks the question straight from the address, as dma-debug already does.