CVE-2026-64149
Received Received - Intake

DMA Mapping Resource Sanity Check Fix in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dma_map_resource() sanity check into debug code dma_map_resource() uses pfn_valid() to ensure the range is not RAM. However, pfn_valid() only checks for availability of the memory map for a PFN but it does not ensure that the PFN is actually backed by RAM. On ARM64 with SPARSEMEM (128MB section granularity), MMIO addresses that share a section with RAM will falsely trigger the WARN_ON_ONCE and cause dma_map_resource() to return DMA_MAPPING_ERROR. This causes a WARNING on Raspberry Pi 4 during spi_bcm2835 probe because the SPI FIFO register (0xfe204004) falls in the same sparsemem section as the end of RAM (0xf8000000-0xfbffffff), both in section 31 (0xf8000000-0xffffffff). Move the sanity check from dma_map_resource() into debug_dma_map_phys() and replace the unreliable pfn_valid() with pfn_valid() && !PageReserved(), which correctly identifies actual usable RAM without false positives for MMIO regions that happen to have struct pages. Since dma_map_resource() is dma_map_phys(DMA_ATTR_MMIO), the check applies equally to both APIs. Any non-reserved page represents kernel memory to a sufficient degree that using DMA_ATTR_MMIO on it is almost certainly wrong and risks breaking coherency on non-coherent platforms. ZONE_DEVICE pages used for PCI P2P DMA (MEMORY_DEVICE_PCI_P2PDMA) have PageReserved set, so they will not trigger a false positive. The check no longer blocks the mapping and uses err_printk() to integrate with dma-debug filtering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64149
EUVD
EUVD-2026-45834

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel linux_kernel *
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a false positive in the dma_map_resource() function where pfn_valid() incorrectly identifies MMIO addresses as RAM on ARM64 systems with SPARSEMEM. This causes a WARNING during device probing, such as on Raspberry Pi 4 with SPI FIFO registers.

Detection Guidance

This vulnerability is specific to the Linux kernel's dma-mapping subsystem and may trigger warnings during hardware probing, particularly on ARM64 systems with SPARSEMEM. Detection involves checking kernel logs for warnings related to dma_map_resource or spi_bcm2835 during system boot or hardware initialization.

Impact Analysis

The vulnerability may cause system warnings or errors during device initialization, particularly on ARM64 systems like Raspberry Pi 4. It could disrupt DMA operations for devices with MMIO registers, potentially leading to device failures or reduced functionality.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue related to DMA mapping that could cause system warnings or errors during device probing, but does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the kernel patch that moves the sanity check into debug code and replaces pfn_valid() with a more accurate check. Update to a kernel version containing the fix. Monitor kernel logs for related warnings after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart