CVE-2026-64590: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-j99r-j84h-cmw8
Share
Published
Advisory Summary

CVE-2026-64590 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64590 at a Glance

CVE Identifier CVE-2026-64590
GHSA Identifier GHSA-j99r-j84h-cmw8
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-64590

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64590, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning: DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \ overlapping mappings aren't supported WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0 The call chain is: amdgpu_cs_ioctl -> amdgpu_ttm_backend_bind -> dma_buf_map_attachment -> [udmabuf] map_udmabuf -> get_sg_table -> dma_map_sgtable(dev, sg, direction, 0) // attrs=0 -> debug_dma_map_sg -> add_dma_entry -> EEXIST This happens because udmabuf builds a per-page scatter-gather list via sg_set_folio(). When begin_cpu_udmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via map_udmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap. The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in add_dma_entry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless. All other major dma-buf exporters already pass this flag: - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC The CPU sync at map/unmap time is also redundant for udmabuf: begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU access is requested through the dma-buf interface. Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.

References

NVD — CVE-2026-64590 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64590
git.kernel.org/stable/c/01126abc11... WEB
https://git.kernel.org/stable/c/01126abc11bcc6a45b664293b0b5df715be911d7
git.kernel.org/stable/c/0449a6583c... WEB
https://git.kernel.org/stable/c/0449a6583c0ee76778d314e4e82f166fc97fa9d8
git.kernel.org/stable/c/0db56e7eae... WEB
https://git.kernel.org/stable/c/0db56e7eae932f8e2f3eb44ad1a63633d8f504f8
git.kernel.org/stable/c/3469656346... WEB
https://git.kernel.org/stable/c/34696563461c9a23177feb6d8aff43f4c0510278
git.kernel.org/stable/c/4a7c644e63... WEB
https://git.kernel.org/stable/c/4a7c644e632741c2a3116a0d3da6c11de957a6ba
git.kernel.org/stable/c/504e2b4ab9... WEB
https://git.kernel.org/stable/c/504e2b4ab97a51d56d966cd36d0997ad30b65b2d
git.kernel.org/stable/c/d6552f5cff... WEB
https://git.kernel.org/stable/c/d6552f5cff795d60e629f37513ecf23d88fd2f82
git.kernel.org/stable/c/dd7f1e572f... WEB
https://git.kernel.org/stable/c/dd7f1e572f44d3d039dc77e3989f537196c3bf52

Frequently Asked Questions

What is CVE-2026-64590?
CVE-2026-64590 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64590?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-64590?
CVE-2026-64590 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-64590?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j99r-j84h-cmw8",
  "modified" : "2026-08-23T15:32:56Z",
  "published" : "2026-08-06T09:30:32Z",
  "aliases" : [ "CVE-2026-64590" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning\n\nWhen CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM\ndriver (e.g. amdgpu for video playback in GNOME Videos / Showtime)\ntriggers a spurious warning:\n\n  DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \\\n      overlapping mappings aren't supported\n  WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0\n\nThe call chain is:\n\n  amdgpu_cs_ioctl\n   -> amdgpu_ttm_backend_bind\n    -> dma_buf_map_attachment\n     -> [udmabuf] map_udmabuf -> get_sg_table\n      -> dma_map_sgtable(dev, sg, direction, 0)  // attrs=0\n       -> debug_dma_map_sg -> add_dma_entry -> EEXIST\n\nThis happens because udmabuf builds a per-page scatter-gather list via\nsg_set_folio().  When begin_cpu_udmabuf() has already created an sg\ntable mapped for the misc device, and an importer such as amdgpu maps\nthe same pages for its own device via map_udmabuf(), the DMA debug\ninfrastructure sees two active mappings whose physical addresses share\ncacheline boundaries and warns about the overlap.\n\nThe DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in\nadd_dma_entry() because it signals that no CPU cache maintenance is\nperformed at map/unmap time, making the cacheline overlap harmless.\n\nAll other major dma-buf exporters already pass this flag:\n  - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC\n  - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC\n\nThe CPU sync at map/unmap time is also redundant for udmabuf:\nbegin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit\ncache synchronization via dma_sync_sgtable_for_cpu/device() when CPU\naccess is requested through the dma-buf interface.\n\nPass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and\ndma_unmap_sgtable() in udmabuf to suppress the spurious warning and\nskip the redundant sync.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64590"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/01126abc11bcc6a45b664293b0b5df715be911d7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0449a6583c0ee76778d314e4e82f166fc97fa9d8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0db56e7eae932f8e2f3eb44ad1a63633d8f504f8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/34696563461c9a23177feb6d8aff43f4c0510278"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4a7c644e632741c2a3116a0d3da6c11de957a6ba"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/504e2b4ab97a51d56d966cd36d0997ad30b65b2d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d6552f5cff795d60e629f37513ecf23d88fd2f82"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dd7f1e572f44d3d039dc77e3989f537196c3bf52"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-06T08:16:34Z"
  }
}