CVE-2026-64590
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
06/08/2026
Última modificación:
06/08/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning<br />
<br />
When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM<br />
driver (e.g. amdgpu for video playback in GNOME Videos / Showtime)<br />
triggers a spurious warning:<br />
<br />
DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \<br />
overlapping mappings aren&#39;t supported<br />
WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0<br />
<br />
The call chain is:<br />
<br />
amdgpu_cs_ioctl<br />
-> amdgpu_ttm_backend_bind<br />
-> dma_buf_map_attachment<br />
-> [udmabuf] map_udmabuf -> get_sg_table<br />
-> dma_map_sgtable(dev, sg, direction, 0) // attrs=0<br />
-> debug_dma_map_sg -> add_dma_entry -> EEXIST<br />
<br />
This happens because udmabuf builds a per-page scatter-gather list via<br />
sg_set_folio(). When begin_cpu_udmabuf() has already created an sg<br />
table mapped for the misc device, and an importer such as amdgpu maps<br />
the same pages for its own device via map_udmabuf(), the DMA debug<br />
infrastructure sees two active mappings whose physical addresses share<br />
cacheline boundaries and warns about the overlap.<br />
<br />
The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in<br />
add_dma_entry() because it signals that no CPU cache maintenance is<br />
performed at map/unmap time, making the cacheline overlap harmless.<br />
<br />
All other major dma-buf exporters already pass this flag:<br />
- drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC<br />
- amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC<br />
<br />
The CPU sync at map/unmap time is also redundant for udmabuf:<br />
begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit<br />
cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU<br />
access is requested through the dma-buf interface.<br />
<br />
Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and<br />
dma_unmap_sgtable() in udmabuf to suppress the spurious warning and<br />
skip the redundant sync.
Impacto
Referencias a soluciones, herramientas e información
- https://git.kernel.org/stable/c/0449a6583c0ee76778d314e4e82f166fc97fa9d8
- https://git.kernel.org/stable/c/0db56e7eae932f8e2f3eb44ad1a63633d8f504f8
- https://git.kernel.org/stable/c/34696563461c9a23177feb6d8aff43f4c0510278
- https://git.kernel.org/stable/c/504e2b4ab97a51d56d966cd36d0997ad30b65b2d
- https://git.kernel.org/stable/c/d6552f5cff795d60e629f37513ecf23d88fd2f82



