A flaw in the Linux kernel’s swiotlb DMA bounce buffer logic causes the function to mix an original address with an offset derived from an adjusted address when performing high‑memory page lookups. This miscalculation means that DMA writes may target a page adjacent to the intended target and DMA reads may retrieve data from an unintended page, leading to silent memory corruption. The flaw is a memory read/write error identified as CWE‑787 and can potentially expose or overwrite kernel memory.

All Linux kernels that include the swiotlb bounce buffer mechanism are affected. The advisory specifies that the vulnerability exists in the Linux kernel source without enumerating specific version numbers, meaning any release that has not incorporated the referenced patch commits remains vulnerable.

The CVSS score of 7.8 reflects a high severity impact. The EPSS score of < 1 % indicates that, in practice, this issue is unlikely to be widely exploited. It is not listed in the CISA KEV catalog. Attackers would need to trigger DMA operations—typically via a device driver or firmware that initiates high‑memory mappings—or exploit local privileges to manipulate the mapping logic. Successful exploitation could result in arbitrary kernel‑space memory writes or reads, potentially enabling privilege escalation or denial‑of‑service attacks. Based on the description, the likely attack vector is a local attacker who can influence device‑driver interactions or gain kernel‑privileged execution, as exploitation requires precise control over DMA mappings.