The vulnerability resides in the Linux kernel’s dma_map_resource() function, where it uses pfn_valid() to validate memory ranges. pfn_valid() merely confirms that a page frame number appears in the memory map but does not verify that it is backed by actual RAM. On ARM64 systems using SPARSEMEM with 128 MB section granularity, memory‑mapped I/O (MMIO) addresses that share a section with RAM incorrectly satisfy pfn_valid(). This causes WARN_ON_ONCE to trigger and dma_map_resource() to return DMA_MAPPING_ERROR, which prevents device drivers that rely on DMA_ATTR_MMIO mapping from initializing properly. The result is a warning in the kernel log and a failure of the affected device, as demonstrated by the spi_bcm2835 driver on a Raspberry Pi 4.

The issue affects Linux kernels running on ARM64 architectures with SPARSEMEM enabled. The CVE was observed on a Raspberry Pi 4 platform, but any system that uses dma_map_resource() or dma_map_phys(DMA_ATTR_MMIO) with MMIO addresses falling within a sparse memory section that overlaps RAM is susceptible. All Linux kernel releases are affected; there is no vendor‑specific product list in the CNA data.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is below 1 %, with the vulnerability not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local kernel‑mode or privileged access to trigger the fault during module initialization, as the issue arises while mapping DMA resources. The primary impact is a denial of service to the affected device, with no direct code execution or data exfiltration. Given the limited attack surface and low prevalence of vulnerable configurations, the overall risk for typical deployments remains low, but systems that rely on the affected drivers should consider patching immediately.