The kernel function iommu_dma_map_sg() incorrectly assigns the DMA length for all scatterlist segments in a PCI Programmed‑Peripheral‑to‑Peripheral DMA (P2PDMA) transfer. Instead of using the length of the current segment, the code copies the length from the first segment. This typo causes every segment in a multi‑segment scatterlist to report the same DMA length, potentially leading to truncated or overlapped DMA transfers. The resulting malformed DMA mappings can corrupt kernel memory during data movement, which may expose confidential data, trigger kernel crashes, or create a foothold for escalation of privileges.

The issue affects the Linux kernel in any build that contains the legacy iommu_dma_map_sg() implementation for P2PDMA, regardless of distribution. No specific kernel versions were listed, but the vulnerability exists until the corresponding commit that corrects the length assignment is applied. Consequently, all unpatched Linux kernel systems using PCI P2PDMA devices are potentially impacted.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is less than 1%, indicating a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so there are no confirmed widespread exploits as of now. The likely attack vector is local: an attacker would need to influence a PCI device that initiates a P2PDMA transfer or compromise a driver that uses iommu_dma_map_sg(). If successfully exploited, the malformed DMA length could overwrite kernel memory, causing denial of service or privilege escalation. The risk is therefore high for systems that allow untrusted drivers or devices to perform P2PDMA DMA transfers.