---
title: "CVE-2026-89995: CVE-2026-89995"
description: "In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() Commit 5b138c534fda (\"dma-direct: factor out a dma_direct_alloc_from_pool helper\") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *. Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller."
url: https://panop.io/threat-heartbeat/CVE-2026-89995/
---

# CVE-2026-89995 CVE-2026-89995

In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma\_direct\_alloc\_from\_pool() Commit 5b138c534fda ("dma-direct: factor out a dma\_direct\_alloc\_from\_pool helper") changed dma\_direct\_alloc\_from\_pool() to return the CPU address from dma\_alloc\_from\_pool(). That fits dma\_direct\_alloc(), but dma\_direct\_alloc\_pages() also uses the helper and expects a struct page \*. Fix this by making dma\_direct\_alloc\_from\_pool() return the struct page \* again, and pass the CPU address back through an out-parameter for the dma\_direct\_alloc() caller.

CVSS base score 8.8 /10

High

CISA KEV

Not listed

Public exploit

None known

EPSS

0.32% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89995)

## Details

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

16 September 2026

Updated

15 October 2026

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89995](https://nvd.nist.gov/vuln/detail/CVE-2026-89995)
- [https://git.kernel.org/stable/c/94a04ad732c9f8b9554270fc4038a06737de5c22](https://git.kernel.org/stable/c/94a04ad732c9f8b9554270fc4038a06737de5c22)
- [https://git.kernel.org/stable/c/c3fdb94da43ff23287f85664174c45c45e881a3f](https://git.kernel.org/stable/c/c3fdb94da43ff23287f85664174c45c45e881a3f)
- [https://git.kernel.org/stable/c/feeb2ef775081a6c188cdd10e7a45369a07ce531](https://git.kernel.org/stable/c/feeb2ef775081a6c188cdd10e7a45369a07ce531)
- [https://git.kernel.org/stable/c/408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8](https://git.kernel.org/stable/c/408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)