CVE-2026-64590

In the Linux kernel, the following vulnerability has been resolved:

dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning

When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning:

DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \ overlapping mappings aren't supported WARNING: kernel/dma/debug.c:619 at adddmaentry+0x473/0x5f0

The call chain is:

amdgpucsioctl -> amdgputtmbackendbind -> dmabufmapattachment -> [udmabuf] mapudmabuf -> getsgtable -> dmamapsgtable(dev, sg, direction, 0) // attrs=0 -> debugdmamapsg -> adddmaentry -> EEXIST

This happens because udmabuf builds a per-page scatter-gather list via sgsetfolio(). When begincpuudmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via map_udmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap.

The DMAATTRSKIPCPUSYNC flag suppresses this check in adddmaentry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless.

All other major dma-buf exporters already pass this flag: - drmgemmapdmabuf() passes DMAATTRSKIPCPUSYNC - amdgpudmabufmap() passes DMAATTRSKIPCPU_SYNC

The CPU sync at map/unmap time is also redundant for udmabuf: begincpuudmabuf() and endcpuudmabuf() already perform explicit cache synchronization via dmasyncsgtableforcpu/device() when CPU access is requested through the dma-buf interface.

Pass DMAATTRSKIPCPUSYNC to dmamapsgtable() and dmaunmapsgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.