CVE-2026-64590: Linux Kernel DMA-BUF Cache Vulnerability

CVE-2026-64590 Overview

CVE-2026-64590 is a Linux kernel issue in the dma-buf/udmabuf subsystem. When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver such as amdgpu triggers a spurious cacheline tracking EEXIST warning from add_dma_entry(). The warning surfaces during common workloads like video playback in GNOME Videos. The root cause is that udmabuf calls dma_map_sgtable() without the DMA_ATTR_SKIP_CPU_SYNC attribute, causing the DMA debug layer to detect overlapping cacheline mappings between the udmabuf misc device and the importing driver. The fix passes DMA_ATTR_SKIP_CPU_SYNC to both dma_map_sgtable() and dma_unmap_sgtable() in udmabuf.

Critical Impact
The issue is a kernel-debug warning and redundant CPU cache synchronization path rather than a memory-safety flaw. No CVSS score or exploitation impact is defined in the NVD entry.

Affected Products

Linux kernel builds enabling CONFIG_UDMABUF together with CONFIG_DMA_API_DEBUG_SG
DRM stacks importing udmabuf buffers (for example, amdgpu used by GNOME Videos / Showtime)
Stable kernel branches referenced by commits 0449a65, 0db56e7, 3469656, 504e2b4, and d6552f5

Discovery Timeline

2026-08-06 - CVE-2026-64590 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64590

Vulnerability Analysis

The udmabuf exporter builds a per-page scatter-gather list using sg_set_folio(). When begin_cpu_udmabuf() has already created an sg table mapped against the udmabuf misc device, an importer such as amdgpu then maps the same pages for its own device through map_udmabuf(). Both mappings reference physical pages that share cacheline boundaries. The DMA debug infrastructure treats this as overlapping mappings and emits a WARNING at kernel/dma/debug.c:619 in add_dma_entry().

The observed call chain is amdgpu_cs_ioctl → amdgpu_ttm_backend_bind → dma_buf_map_attachment → map_udmabuf → get_sg_table → dma_map_sgtable(dev, sg, direction, 0) → debug_dma_map_sg → add_dma_entry returning EEXIST.

Root Cause

The root cause is a missing DMA attribute flag on the mapping call. Other major dma-buf exporters, including drm_gem_map_dma_buf() and amdgpu_dma_buf_map(), already pass DMA_ATTR_SKIP_CPU_SYNC. That attribute signals that no CPU cache maintenance is performed at map or unmap time, so overlapping cacheline tracking is harmless. Udmabuf performs explicit cache synchronization through dma_sync_sgtable_for_cpu() and dma_sync_sgtable_for_device() inside begin_cpu_udmabuf() and end_cpu_udmabuf(), making the map-time sync redundant.

Attack Vector

No attack vector is defined. The condition is a debug-time false positive that also triggers redundant CPU cache synchronization. Impact is limited to spurious kernel log noise and unnecessary work when udmabuf is used alongside DRM importers on debug-enabled kernels.

See the upstream fix in the referenced Kernel Git Commit 0449a65 for the exact source change.

Detection Methods for CVE-2026-64590

Indicators of Compromise

Kernel log entries containing DMA-API: ... cacheline tracking EEXIST, overlapping mappings aren't supported
WARNING backtraces originating in add_dma_entry+0x473/0x5f0 at kernel/dma/debug.c:619
Warnings emitted during dma-buf import paths such as amdgpu_ttm_backend_bind → dma_buf_map_attachment → map_udmabuf

Detection Strategies

Grep dmesg and /var/log/kern.log for the cacheline tracking EEXIST string across fleet hosts.
Identify kernels built with both CONFIG_UDMABUF=y and CONFIG_DMA_API_DEBUG_SG=y and compare running versions against the fixed stable commits.
Correlate warning timestamps with DRM/GPU workloads and media playback sessions to confirm the udmabuf import path.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM pipeline and alert on new DMA-API warnings.
Track kernel package versions against distribution security advisories referencing CVE-2026-64590.
Baseline warning counts before and after patch deployment to confirm the fix is effective.

How to Mitigate CVE-2026-64590

Immediate Actions Required

Inventory kernels that enable CONFIG_UDMABUF and CONFIG_DMA_API_DEBUG_SG, focusing on developer and QA systems where debug options are common.
Apply the stable kernel updates that include the udmabuf DMA_ATTR_SKIP_CPU_SYNC fix.
Rebuild and reboot affected hosts, then verify that the cacheline tracking EEXIST warning no longer appears under DRM/udmabuf workloads.

Patch Information

The fix passes DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in the udmabuf driver, suppressing the false-positive DMA debug warning and eliminating redundant CPU cache maintenance. It has been merged across multiple stable branches. Reference commits: Kernel Git Commit 0449a65, Kernel Git Commit 0db56e7, Kernel Git Commit 3469656, Kernel Git Commit 504e2b4, and Kernel Git Commit d6552f5.

Workarounds

Disable CONFIG_DMA_API_DEBUG_SG in production kernel builds where DMA debug tracking is not required.
Avoid combining udmabuf-based dma-buf sharing with DMA debug on the same kernel until patched packages are installed.
Restrict use of debug kernels to isolated development environments to reduce log noise on production fleets.

bash

# Verify affected configuration and check for the warning signature
grep -E 'CONFIG_UDMABUF|CONFIG_DMA_API_DEBUG_SG' /boot/config-$(uname -r)
dmesg | grep -i 'cacheline tracking EEXIST'