CVE-2026-72064

This CVE exposes a DMA synchronization bug that lives in the gap between what an API contract promises and what developers assume it guarantees. The MANA network driver's RX path made what appeared to be a reasonable optimization: skip dma_unmap_single() when returning page pool fragments, since the page pool presumably handles DMA address lifecycle. The problem is that dma_unmap_single() doesn't just unmap the DMA address — it performs sync-for-CPU, making the memory coherent for the CPU before data access. The driver assumed this sync happened somewhere else, and on most hardware it did, because other code paths happened to perform it. But under explicit DMA constraints like swiotlb=force, that implicit sync never occurs, and the driver reads stale data. The fix — recording the page and offset, then explicitly calling the sync operation — is technically simple. What it reveals is not: the page pool API documentation never explicitly states that callers retain CPU sync responsibility when they skip the unmap call. The assumption wasn't documented, wasn't wrong in testing, and wasn't caught in review. It survived because the conditions that invalidate it (swiotlb-bound systems, explicit IOMMU bounce buffers) are systematically excluded from normal development and CI environments. Most developers have never worked on a swiotlb=force system, so the failure mode is not just undetected but cognitively inaccessible. The broader concern is whether other page pool consumers made the same assumption. The optimization pattern — skip unmap because page pool owns it — is intuitive and was likely copied across drivers. The fix commit message will either explain the semantic gap clearly or just say 'sync RX frags for CPU' and leave future driver authors to rediscover the same mistake. If you're maintaining drivers that use page pool, audit your code for any path that skips dma_unmap_single() or dma_unmap_page() without an explicit sync-for-CPU call. The page pool owns DMA address lifecycle, but CPU coherence is a separate obligation that the API never transferred. Check your RX and TX paths, especially any fast-path optimizations that elided these calls under the assumption that 'the pool handles it.'

Reviewed through automated stages and approved by a human before publication.