CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
A bug in the Linux kernel MMP PDMA driver causes out-of-bounds reads and data loss due to incorrect scatterlist length handling, potentially exposing memory or corrupting data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98298?
CVE-2026-98298 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry):
for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */
Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.
Which versions are affected by CVE-2026-98298?
How do I fix CVE-2026-98298?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98298 being exploited?
There is no known exploitation of CVE-2026-98298 in the wild and no public exploit code.
Sources
Also known as AZL-106131, BELL-CVE-2026-98298, DEBIAN-CVE-2026-98298, GHSA-262v-749m-59x9, UBUNTU-CVE-2026-98298.