CVE-2026-64590: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
In the Linux kernel, the following vulnerability has been resolved:
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning:
DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \ overlapping mappings aren't supported WARNING: kernel/dma/debug.c:619 at adddmaentry+0x473/0x5f0
The call chain is:
amdgpucsioctl -> amdgputtmbackendbind -> dmabufmapattachment -> [udmabuf] mapudmabuf -> getsgtable -> dmamapsgtable(dev, sg, direction, 0) // attrs=0 -> debugdmamapsg -> adddmaentry -> EEXIST
This happens because udmabuf builds a per-page scatter-gather list via sgsetfolio(). When begincpuudmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via mapudmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap.
The DMAATTRSKIPCPUSYNC flag suppresses this check in adddmaentry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless.
All other major dma-buf exporters already pass this flag: - drmgemmapdmabuf() passes DMAATTRSKIPCPUSYNC - amdgpudmabufmap() passes DMAATTRSKIPCPUSYNC
The CPU sync at map/unmap time is also redundant for udmabuf: begincpuudmabuf() and endcpuudmabuf() already perform explicit cache synchronization via dmasyncsgtableforcpu/device() when CPU access is requested through the dma-buf interface.
Pass DMAATTRSKIPCPUSYNC to dmamapsgtable() and dmaunmapsgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update udmabuf to pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable(dev, sg, direction, attrs) (i.e., use dma_map_sgtable(..., 0) -> use the DMA_ATTR_SKIP_CPU_SYNC flag) so the redundant CPU sync/check is suppressed and the CONFIG_DMA_API_DEBUG_SG EEXIST warning is avoided.
Linux kernel DMA API (dma_map_sgtable / dma-buf/udmabuf) DMA_ATTR_SKIP_CPU_SYNC passed to dma_map_sgtable() = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64590?
The severity of CVE-2026-64590 is rated at 4, indicating a moderate level of risk.
How do I fix CVE-2026-64590?
To fix CVE-2026-64590, ensure that you have applied the latest patch provided within the Linux kernel updates.
What impact does CVE-2026-64590 have on system performance?
CVE-2026-64590 may cause performance issues due to redundant CPU synchronization when importing a udmabuf into a DRM driver.
Which Linux kernel version addresses CVE-2026-64590?
CVE-2026-64590 is addressed in the Linux kernel version that includes patches resolving the issue related to dma-buf and udmabuf.
Who is affected by CVE-2026-64590?
Users utilizing the Linux kernel with CONFIG_DMA_API_DEBUG_SG enabled and using drm drivers like amdgpu may be affected by CVE-2026-64590.