CVE-2026-46115
Received Received - Intake
Memory Corruption in Linux Kernel

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovec_phys_mergeable biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for whether the segments belong to different dev_pagemaps. When zone device memory is registered in multiple chunks, each chunk gets its own dev_pagemap. A single bio can legitimately contain bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at pgmap boundaries but the outer loop in bio_iov_iter_get_pages() continues filling the same bio. If such bvecs are physically contiguous, biovec_phys_mergeable() will coalesce them, making it impossible to recover the correct pgmap for the merged segment via page_pgmap(). Add a zone_device_pages_have_same_pgmap() check to prevent merging bvec segments that span different pgmaps.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-05-28
AI Q&A
2026-05-28
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's block subsystem, specifically in the function biovec_phys_mergeable(). This function is responsible for deciding if two physically contiguous bvec segments can be merged into one. However, it lacked a check to determine if these segments belong to different dev_pagemaps.

When zone device memory is registered in multiple chunks, each chunk has its own dev_pagemap. A single bio can contain bvecs from different pgmaps. The current merging logic can incorrectly merge physically contiguous bvecs from different pgmaps, making it impossible to correctly identify the original pgmap for the merged segment.

The fix adds a check called zone_device_pages_have_same_pgmap() to prevent merging bvec segments that span different pgmaps, ensuring the integrity of the mapping information.


How can this vulnerability impact me? :

This vulnerability can cause incorrect merging of memory segments that belong to different device page maps. As a result, the system may lose the ability to correctly track the original memory mappings.

Such incorrect merging could potentially lead to data integrity issues or unexpected behavior in memory management, especially in systems using zone device memory registered in multiple chunks.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart