{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-64149 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64149 is a medium-severity denial of service vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64149 and fix it if it is affected.\n\nWhat it is: CVE-2026-64149 is a medium-severity denial of service vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64149 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64149/ (Markdown: https://insights.sbomify.com/CVE-2026-64149/index.md)","id":"CVE-2026-64149","markdown":"https://insights.sbomify.com/CVE-2026-64149/index.md","name":"CVE-2026-64149","record":{"aliases":["BELL-CVE-2026-64149","DEBIAN-CVE-2026-64149","GHSA-pxq7-6qx3-6gp9","UBUNTU-CVE-2026-64149"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A false positive in the Linux kernel DMA mapping sanity check causes unnecessary warnings and mapping errors on ARM64 systems, potentially disrupting device drivers.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-mapping: move dma_map_resource() sanity check into debug code\n\ndma_map_resource() uses pfn_valid() to ensure the range is not RAM.\nHowever, pfn_valid() only checks for availability of the memory map for\na PFN but it does not ensure that the PFN is actually backed by RAM. On\nARM64 with SPARSEMEM (128MB section granularity), MMIO addresses that\nshare a section with RAM will falsely trigger the WARN_ON_ONCE and cause\ndma_map_resource() to return DMA_MAPPING_ERROR.\n\nThis causes a WARNING on Raspberry Pi 4 during spi_bcm2835 probe because\nthe SPI FIFO register (0xfe204004) falls in the same sparsemem section\nas the end of RAM (0xf8000000-0xfbffffff), both in section 31\n(0xf8000000-0xffffffff).\n\nMove the sanity check from dma_map_resource() into debug_dma_map_phys()\nand replace the unreliable pfn_valid() with pfn_valid() \u0026\u0026\n!PageReserved(), which correctly identifies actual usable RAM without\nfalse positives for MMIO regions that happen to have struct pages.\n\nSince dma_map_resource() is dma_map_phys(DMA_ATTR_MMIO), the check\napplies equally to both APIs. Any non-reserved page represents kernel\nmemory to a sufficient degree that using DMA_ATTR_MMIO on it is almost\ncertainly wrong and risks breaking coherency on non-coherent platforms.\nZONE_DEVICE pages used for PCI P2P DMA (MEMORY_DEVICE_PCI_P2PDMA) have\nPageReserved set, so they will not trigger a false positive.\n\nThe check no longer blocks the mapping and uses err_printk() to\nintegrate with dma-debug filtering.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"dma-mapping: move dma_map_resource() sanity check into debug code","id":"CVE-2026-64149","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"netfilter: nft_inner: release local_lock before re-enabling softirqs","id":"CVE-2026-64150"},"packages":[],"prev":{"headline":"pds_core: fix error handling in pdsc_devcmd_wait","id":"CVE-2026-64148"},"products":["Linux"],"published":"2026-07-19","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-07-19","vendors":["Linux"]},"summary":"A false positive in the Linux kernel DMA mapping sanity check causes unnecessary warnings and mapping errors on ARM64 systems, potentially disrupting device drivers.","url":"https://insights.sbomify.com/CVE-2026-64149/"}