CVE-2026-64149: dma-mapping: move dma_map_resource() sanity check into debug code
In the Linux kernel, the following vulnerability has been resolved:
dma-mapping: move dmamapresource() sanity check into debug code
dmamapresource() uses pfnvalid() to ensure the range is not RAM. However, pfnvalid() only checks for availability of the memory map for a PFN but it does not ensure that the PFN is actually backed by RAM. On ARM64 with SPARSEMEM (128MB section granularity), MMIO addresses that share a section with RAM will falsely trigger the WARNONONCE and cause dmamapresource() to return DMAMAPPINGERROR.
This causes a WARNING on Raspberry Pi 4 during spibcm2835 probe because the SPI FIFO register (0xfe204004) falls in the same sparsemem section as the end of RAM (0xf8000000-0xfbffffff), both in section 31 (0xf8000000-0xffffffff).
Move the sanity check from dmamapresource() into debugdmamapphys() and replace the unreliable pfnvalid() with pfnvalid() && !PageReserved(), which correctly identifies actual usable RAM without false positives for MMIO regions that happen to have struct pages.
Since dmamapresource() is dmamapphys(DMAATTRMMIO), the check applies equally to both APIs. Any non-reserved page represents kernel memory to a sufficient degree that using DMAATTRMMIO on it is almost certainly wrong and risks breaking coherency on non-coherent platforms. ZONEDEVICE pages used for PCI P2P DMA (MEMORYDEVICEPCIP2PDMA) have PageReserved set, so they will not trigger a false positive.
The check no longer blocks the mapping and uses errprintk() to integrate with dma-debug filtering.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64149?
CVE-2026-64149 has a risk rating of 12, indicating a high severity vulnerability.
How do I fix CVE-2026-64149?
To fix CVE-2026-64149, ensure you update to the latest version of the Linux kernel where this vulnerability has been addressed.
What systems are affected by CVE-2026-64149?
CVE-2026-64149 affects versions of the Linux kernel that utilize the dma-mapping code.
Can CVE-2026-64149 be exploited remotely?
CVE-2026-64149 may lead to potential vulnerabilities allowing exploit by malicious entities if not patched.
What is the impact of CVE-2026-64149?
The impact of CVE-2026-64149 relates to faulty memory access that could compromise system stability and security.