Unrated severityNVD Advisory· Published May 28, 2026

CVE-2026-46115

Description

In the Linux kernel, the following vulnerability has been resolved:

block: add pgmap check to biovec_phys_mergeable

biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for whether the segments belong to different dev_pagemaps.

When zone device memory is registered in multiple chunks, each chunk gets its own dev_pagemap. A single bio can legitimately contain bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at pgmap boundaries but the outer loop in bio_iov_iter_get_pages() continues filling the same bio. If such bvecs are physically contiguous, biovec_phys_mergeable() will coalesce them, making it impossible to recover the correct pgmap for the merged segment via page_pgmap().

Add a zone_device_pages_have_same_pgmap() check to prevent merging bvec segments that span different pgmaps.

Affected products

Linux/Kernelllm-fuzzy

Patches

f17d52107532

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitNaman JainApr 10, 2026Fixed in 6.18.30via kernel-cna

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 80a6a942a10afc..59bd91a4acc4d0 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 80a6a942a10afc..59bd91a4acc4d0 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

f632dab4b841

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitNaman JainApr 10, 2026Fixed in 7.0.7via kernel-cna

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index a55e2e4fcda4f9..a7abf3be34ef8a 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index a55e2e4fcda4f9..a7abf3be34ef8a 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

3d2ecbd444b0

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitNaman JainApr 10, 2026Fixed in 6.6.140via kernel-cna

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 67915b04b3c179..2a0f9120750faa 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -95,6 +95,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 67915b04b3c179..2a0f9120750faa 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -95,6 +95,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

a7f3aa8c9df3

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitNaman JainApr 10, 2026Fixed in 6.12.88via kernel-cna

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 8af4f7101c8a84..2a355ed506c579 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -117,6 +117,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 8af4f7101c8a84..2a355ed506c579 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -117,6 +117,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

13920e4b7b78

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitNaman JainApr 10, 2026Fixed in 7.1-rc1via kernel-cna

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index ec4674cdf2ead4..50a41db0391331 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -127,6 +127,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index ec4674cdf2ead4..50a41db0391331 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -127,6 +127,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

f17d52107532

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitNaman JainApr 10, 2026via nvd-ref

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 80a6a942a10afc..59bd91a4acc4d0 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 80a6a942a10afc..59bd91a4acc4d0 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

f632dab4b841

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitNaman JainApr 10, 2026via nvd-ref

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index a55e2e4fcda4f9..a7abf3be34ef8a 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index a55e2e4fcda4f9..a7abf3be34ef8a 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

13920e4b7b78

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitNaman JainApr 10, 2026via nvd-ref

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index ec4674cdf2ead4..50a41db0391331 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -127,6 +127,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index ec4674cdf2ead4..50a41db0391331 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -127,6 +127,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

3d2ecbd444b0

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitNaman JainApr 10, 2026via nvd-ref

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 67915b04b3c179..2a0f9120750faa 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -95,6 +95,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 67915b04b3c179..2a0f9120750faa 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -95,6 +95,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

a7f3aa8c9df3

block: add pgmap check to biovec_phys_mergeable

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitNaman JainApr 10, 2026via nvd-ref

commit

2 files changed · +4 −2

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 8af4f7101c8a84..2a355ed506c579 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -117,6 +117,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

block/blk.h+2 −1 modified

diff --git a/block/blk.h b/block/blk.h
index 8af4f7101c8a84..2a355ed506c579 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -117,6 +117,8 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,
 
 	if (addr1 + vec1->bv_len != addr2)
 		return false;
+	if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page))
+		return false;
 	if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page))
 		return false;
 	if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask))
-- 
cgit 1.3-korg

Vulnerability mechanics

Root cause

"Missing dev_pagemap boundary check in biovec_phys_mergeable() allows coalescing bvec segments from different pgmaps."

Attack vector

When zone device memory is registered in multiple chunks, each chunk gets its own `dev_pagemap`. A single bio can legitimately contain bvecs from different pgmaps — `iov_iter_extract_bvecs()` breaks at pgmap boundaries but the outer loop in `bio_iov_iter_get_pages()` continues filling the same bio [patch_id=2898576]. If such bvecs are physically contiguous, `biovec_phys_mergeable()` will coalesce them, making it impossible to recover the correct pgmap for the merged segment via `page_pgmap()`. An attacker who can control I/O to zone device memory spanning multiple pgmap chunks can trigger this incorrect coalescing.

Affected code

The vulnerability is in the `biovec_phys_mergeable()` function in `block/blk.h` [patch_id=2898576]. This function is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one.

What the fix does

The patch adds a single check inside `biovec_phys_mergeable()`: `if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page)) return false;` [patch_id=2898576]. This ensures that two physically contiguous bvec segments are only coalesced if they belong to the same `dev_pagemap`. The check is inserted after the existing physical-contiguity test (`addr1 + vec1->bv_len != addr2`) and before the Xen-specific merge check, so it correctly short-circuits merging when the pgmaps differ.

Preconditions

configZone device memory must be registered in multiple chunks, each with its own dev_pagemap.
inputA bio must contain bvecs from different pgmaps that are physically contiguous.

Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000