CVE-2026-46312

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: videobuf2: Set vma_flags in vb2_dma_sg_mmap

vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not

see a reason why vb2_dma_sg should behave differently. This avoids

hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in

drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of

tree Apple ISP camera capture driver which uses vb2_dma_sg_memops.

gst-launch-1.0 v4l2src ! gtk4paintablesink

[ 38.201528] ------------[ cut here ]------------

[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210

[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer

snd_seq snd_seq_device uinput nf_conntrack_netbios_ns

nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib

nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat

nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep

nls_ascii i2c_dev l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References