CVE-2026-64590: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-64590 is a denial-of-service vulnerability in the Linux kernel's dma-buf/udmabuf subsystem that triggers spurious kernel warnings when CONFIG_DMA_API_DEBUG_SG is enabled. When a udmabuf is imported into a DRM driver (e.g., amdgpu during video playback), the DMA debug infrastructure incorrectly flags overlapping cacheline mappings, flooding system logs and potentially degrading stability. The vulnerability affects Linux kernel versions from 5.6 up to (but not including) the patched stable releases. It was published on August 6, 2026, with a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is that udmabuf's map_udmabuf() function calls dma_map_sgtable() without the DMA_ATTR_SKIP_CPU_SYNC flag (i.e., attrs=0). When begin_cpu_udmabuf() has already created a scatter-gather table mapped for the misc device, a subsequent importer (e.g., amdgpu) maps the same physical pages for its own device, causing the DMA debug layer (add_dma_entry()) to detect two active mappings sharing cacheline boundaries and emit an EEXIST warning. The overlap is harmless because begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device(), making the implicit CPU sync at map/unmap time redundant. All other major dma-buf exporters (e.g., drm_gem_map_dma_buf(), amdgpu_dma_buf_map()) already pass DMA_ATTR_SKIP_CPU_SYNC to avoid this issue. The call chain is: amdgpu_cs_ioctl → amdgpu_ttm_backend_bind → dma_buf_map_attachment → map_udmabuf → get_sg_table → dma_map_sgtable → debug_dma_map_sg → add_dma_entry → EEXIST (GitHub Advisory).

Exploitation causes the kernel to emit repeated spurious WARNING messages via kernel/dma/debug.c, which can flood system logs and degrade system stability on affected hosts. The impact is limited to availability — confidentiality and integrity are not directly affected — but log flooding can obscure legitimate security events and impair monitoring. The vulnerability is triggerable by any local user who can initiate video playback or otherwise cause a udmabuf import into a DRM driver on a kernel built with CONFIG_DMA_API_DEBUG_SG (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access and a kernel compiled with the CONFIG_DMA_API_DEBUG_SG debug option, which is not typically enabled in production kernels, significantly limiting the attack surface. The EPSS score is approximately 0.156% (5th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

• Logs: Repeated kernel warning messages in dmesg or /var/log/kern.log of the form: DMA-API: amdgpu 0000:XX:XX.X: cacheline tracking EEXIST, overlapping mappings aren't supported and WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0.
• Process: Unusual volume of kernel warnings correlated with video playback activity (e.g., GNOME Videos / Showtime) or any application performing udmabuf imports into a DRM driver.
• System: Presence of CONFIG_DMA_API_DEBUG_SG=y in the running kernel configuration (/boot/config-$(uname -r) or /proc/config.gz).

Update the Linux kernel to a patched stable release: 6.6.148 or later (for the 6.6.x branch), 6.12.96 or later (for 6.12.x), 6.18.39 or later (for 6.18.x), 7.1.4 or later (for 7.1.x), or any 7.2+ release. The fix passes DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in udmabuf, suppressing the spurious warning. As a temporary workaround on non-production systems, disabling CONFIG_DMA_API_DEBUG_SG in the kernel build configuration will prevent the warning, though this is not recommended where DMA debug detection is needed. Microsoft has also issued an update for the Azure Linux 3 kernel (azl3_kernel_6.6.145.2-1) (GitHub Advisory, Microsoft MSRC).