The Linux kernel vulnerability CVE-2026-64149 involved dma_map_resource() using pfn_valid() alone to verify that a memory range was not RAM before mapping it for DMA. On ARM64 systems with SPARSEMEM, this caused false positives for MMIO addresses sharing sections with RAM, triggering warnings and mapping errors, notably on Raspberry Pi 4 during SPI driver initialization. The fix moves the sanity check into debug_dma_map_phys() and replaces pfn_valid() with pfn_valid() && !PageReserved(), which accurately identifies usable RAM and avoids false positives for MMIO regions. This change prevents incorrect blocking of DMA mappings and integrates error reporting with dma-debug filtering.

The vulnerability caused false warnings and DMA mapping errors on affected ARM64 systems with SPARSEMEM, potentially disrupting device driver initialization (e.g., SPI on Raspberry Pi 4). It did not directly allow unauthorized access or code execution but could lead to functional issues or degraded device operation due to incorrect DMA mapping behavior.

This vulnerability has been resolved in the Linux kernel by moving the sanity check into debug code and improving the validation logic. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly stated here; check the vendor or Linux kernel mailing lists for the specific fixed kernel version.