CVE-2026-23390: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23390 is a buffer overflow vulnerability in the Linux kernel's dma_map_sg tracepoint that can trigger a perf buffer overflow when tracing large scatter-gather lists. It affects Linux kernel versions from 6.12.1 up to (but not including) 6.12.74, and from 6.13 up to (but not including) 6.18.13, as well as pre-release 6.19 release candidates. Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.126.1-1 is also listed as a vulnerable product. The vulnerability was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Red Hat Bugzilla, Microsoft).

The root cause is an incorrect calculation of buffer size (CWE-131) leading to an out-of-bounds write (CWE-787) in the kernel's DMA tracing subsystem. When the dma_map_sg tracepoint processes large scatter-gather lists — such as those generated by virtio-gpu when creating large DRM buffers — the three dynamic arrays (phys_addrs, dma_addrs, and lengths) can collectively consume approximately 20,000 bytes for 1,000 scatter-gather entries, far exceeding the PERF_MAX_TRACE_SIZE limit of 8,192 bytes. This triggers a kernel warning at kernel/trace/trace_event_perf.c:405 (perf buffer not large enough, wanted 24620, have 8192) and can result in a buffer overflow condition. The fix caps all three arrays at 128 entries using min(nents, DMA_TRACE_MAX_ENTRIES) in the array size calculation (Red Hat Bugzilla, Feedly).

Successful exploitation can result in high confidentiality, integrity, and availability impacts on the affected system, as reflected in the CVSS v3.1 score of 7.8. In practice, the most immediate consequence is a denial-of-service condition manifesting as kernel warnings and incomplete or corrupted trace data when DMA tracing is active with large buffer mappings. Systems using devices such as virtio-gpu that generate large DRM buffers with scatter-gather lists exceeding 1,000 entries are particularly at risk during active tracing sessions (Feedly, Red Hat Bugzilla).

• Logs: Kernel warning messages in dmesg or system logs such as WARNING: CPU: X PID: XXXX at kernel/trace/trace_event_perf.c:405 and perf buffer not large enough, wanted XXXXX, have 8192, indicating a triggered buffer overflow condition during DMA tracing.
• Process: Unusual or repeated kernel warnings associated with processes performing large DMA buffer mappings (e.g., virtio-gpu or similar DRM buffer-intensive workloads) while kernel tracing (dma_map_sg tracepoint) is enabled.
• System Behavior: Incomplete or truncated trace data from dma_map_sg tracepoint events when scatter-gather lists exceed 128 entries, observable via perf or ftrace tooling.

Apply the upstream Linux kernel patches that cap the dma_map_sg tracepoint dynamic arrays at 128 entries. Fixed versions are Linux kernel 6.12.74, 6.18.13, and 6.19 (stable release). Patch commits are available at 02d209bb018a40dee9eac89e91860253dee9605b, f2584f791a10343bdc995ff6ff402db45b95de69, and daafcc0ef0b358d9d622b6e3b7c43767aa3814ee in the Linux stable tree. As a temporary workaround, disabling the dma_map_sg tracepoint on affected systems performing large DMA buffer operations can mitigate the overflow risk until patching is feasible (Red Hat Bugzilla, Feedly).

The fix was reviewed by Sean Anderson (sean.anderson@linux.dev) and the patch design was refined based on feedback from Steven Rostedt (Linux tracing maintainer), who suggested using dynamic sizing with min(nents, DMA_TRACE_MAX_ENTRIES) rather than a fixed allocation. The vulnerability was reported and tracked through Red Hat's security response process and the upstream Linux CVE announcement mailing list (Red Hat Bugzilla).