CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Nouveau driver, specifically in the handling of device-private transparent huge pages (THP) during migration, where an incorrect DMA unmap size can lead to memory leaks. This issue could potentially expose sensitive data by failing to unmap the entire IOMMU/IOVA mapping for large folio pages, thereby increasing the risk of unauthorized access to memory. Organizations using Linux systems with the Nouveau driver, particularly those managing large memory configurations, should prioritize addressing this vulnerability to mitigate potential data leakage risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with page_size() and records that length in dma_info->size. For a compound folio page_size() is PAGE_SIZE << order, but two teardown sites still pass a literal PAGE_SIZE to dma_unmap_page(): - nouveau_dmem_migrate_to_ram() on the success path, and - nouveau_dmem_migrate_copy_one() on the copy-error path. For an order > 0 folio this unmaps less than was mapped, leaking the remainder of the IOMMU/IOVA mapping. The other unmap sites, in nouveau_dmem_migrate_chunk() and nouveau_dmem_evict_chunk(), already use the saved size; use it here too.