In the Linux kernel's dma‑buf subsystem a 32‑bit unsigned integer was used to sum total I/O virtual address lengths for peer‑to‑peer DMA paths that cross a host bridge. When the sum exceeded 4 GB, the counter silently wrapped, truncating the length passed to functions such as fill_sg_entry. This silent overflow can corrupt the scatter‑gather list that the kernel builds, potentially allowing an attacker to overwrite arbitrary kernel memory or crash the system. The weakness is a classic integer overflow (CWE‑190) that can lead to memory corruption and denial of service.

The flaw affects all Linux kernel builds that incorporate the upstream dma‑buf code and enable peer‑to‑peer DMA over a host bridge. It is relevant to distributions using kernels older than the fix commit, particularly systems that expose large memory‑mapped I/O regions (> 4 GB) to kernel DMA handling. The vulnerability is present in generic kernel sources and any vendor custom kernels that have not incorporated the size_t change for mapped_len or the check_add_overflow guard in calc_sg_nents.

The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation remains uncertain. The attack requires a device with a MMIO region greater than 4 GB and privileged control over the DMA engine, which limits the applicable attack surface to specialized hardware environments. Based on the description, it is inferred that the path to exploitation is through the kernel's DMA APIs and requires either compromised drivers or an attacker with kernel privileges. Despite the constraints, the potential for memory corruption and a possible denial‑of‑service warrants timely remediation.