CVE-2026-64149 Overview
CVE-2026-64149 addresses a Linux kernel defect in the DMA mapping subsystem. The dma_map_resource() function relies on pfn_valid() to confirm a physical range is not RAM. On ARM64 systems using SPARSEMEM with 128MB section granularity, MMIO addresses sharing a section with RAM trigger a false WARN_ON_ONCE and force dma_map_resource() to return DMA_MAPPING_ERROR. The issue was observed on Raspberry Pi 4 during spi_bcm2835 probe, where the SPI FIFO register at 0xfe204004 shares sparsemem section 31 with the end of RAM. The fix moves the sanity check into debug_dma_map_phys() and replaces pfn_valid() with pfn_valid() && !PageReserved().
Critical Impact
Legitimate DMA resource mappings for MMIO regions fail on ARM64 SPARSEMEM systems, producing kernel warnings and preventing device drivers such as spi_bcm2835 from probing successfully.
Affected Products
- Linux kernel with ARM64 SPARSEMEM configuration (128MB section granularity)
- Systems where MMIO regions share a sparsemem section with RAM, including Raspberry Pi 4
- Drivers using dma_map_resource() / dma_map_phys(DMA_ATTR_MMIO) such as spi_bcm2835
Discovery Timeline
- 2026-07-19 - CVE-2026-64149 published to the National Vulnerability Database
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64149
Vulnerability Analysis
The defect resides in the Linux kernel DMA mapping layer. dma_map_resource() is intended to map device MMIO physical addresses for DMA, and it must reject ranges that correspond to normal RAM to prevent coherency violations on non-coherent platforms. The original guard used pfn_valid(), which only reports whether a memory map entry exists for a given page frame number. It does not confirm that the page frame is actually backed by usable RAM.
On ARM64 with SPARSEMEM at 128MB granularity, a single section can span both the tail of RAM and neighboring MMIO. pfn_valid() returns true for both, so the WARN fires against valid MMIO mappings. The Raspberry Pi 4 case demonstrates this: RAM ends at 0xfbffffff and the SPI FIFO sits at 0xfe204004, both in section 31 (0xf8000000-0xffffffff).
Root Cause
The root cause is an incorrect assumption that pfn_valid() distinguishes RAM from MMIO. It only checks memory map presence. Section-granular sparsemem allocates struct page entries for entire sections, including holes and adjacent MMIO. The check therefore produces false positives and blocks legitimate device mappings.
Attack Vector
This issue is a functional correctness bug rather than a remotely exploitable flaw. There is no known attack vector. Impact is limited to driver probe failures, spurious kernel warnings, and DMA setup errors on affected ARM64 hardware. The fix relocates the sanity check into debug_dma_map_phys() and augments the predicate with !PageReserved(), which correctly identifies usable kernel RAM. ZONE_DEVICE pages backing PCI peer-to-peer DMA (MEMORY_DEVICE_PCI_P2PDMA) carry PageReserved, so they do not produce false positives. The check now uses err_printk() to integrate with dma-debug filtering and no longer blocks the mapping.
Detection Methods for CVE-2026-64149
Indicators of Compromise
- Kernel log entries containing WARN_ON_ONCE originating from dma_map_resource() on ARM64 systems
- spi_bcm2835 probe failures on Raspberry Pi 4 accompanied by DMA_MAPPING_ERROR returns
- Driver initialization errors for MMIO regions whose physical addresses fall within a sparsemem section shared with RAM
Detection Strategies
- Review dmesg output for warnings referencing dma_map_resource or dma_map_phys on ARM64 kernels built with SPARSEMEM
- Compare failing MMIO physical addresses against RAM boundaries to confirm sparsemem section overlap
- Track kernel version and patch level across ARM64 fleets to identify hosts running vulnerable builds
Monitoring Recommendations
- Aggregate kernel warnings from ARM64 devices into a centralized logging pipeline for review
- Alert on driver probe failures for peripherals that depend on dma_map_resource()
- Verify that debug builds enable CONFIG_DMA_API_DEBUG so debug_dma_map_phys() produces actionable diagnostics
How to Mitigate CVE-2026-64149
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the Kernel Security Patch, Kernel Commit Details, and Kernel Commit Analysis
- Rebuild and redeploy ARM64 kernels on affected devices such as Raspberry Pi 4
- Validate that spi_bcm2835 and other DMA-consuming drivers probe successfully after patching
Patch Information
The fix moves the sanity check from dma_map_resource() into debug_dma_map_phys() and replaces pfn_valid() with pfn_valid() && !PageReserved(). Because dma_map_resource() is dma_map_phys(DMA_ATTR_MMIO), the corrected check applies to both APIs. The revised check reports through err_printk() and no longer blocks the mapping, so legitimate MMIO ranges are handled correctly on SPARSEMEM systems.
Workarounds
- Disable CONFIG_DMA_API_DEBUG in kernel builds where the warning is disruptive and patching is not yet possible
- On Raspberry Pi 4 and similar hardware, defer use of drivers that call dma_map_resource() for MMIO adjacent to RAM until a patched kernel is deployed
- Backport the referenced commits to long-term-support kernels used in production ARM64 fleets
# Verify the running kernel includes the corrected check
grep -E 'debug_dma_map_phys|dma_map_resource' /proc/kallsyms
dmesg | grep -iE 'dma_map_resource|WARN.*dma'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
