Executive brief
A vulnerability was identified in the Linux kernel's block layer, which manages how data is transferred between system memory and storage devices. The issue occurs when the system incorrectly combines separate memory segments into a single block, making it impossible for the kernel to correctly identify the memory's origin. This could lead to system instability or data integrity issues during high-performance storage operations.
Technical details
A vulnerability in the Linux kernel's block layer involves the `biovec_phys_mergeable()` function, which is used during request merging, DMA mapping, and integrity merge paths. The function lacked a check to determine if physically contiguous `bvec` segments belonged to different `dev_pagemaps`. When zone device memory is registered in multiple chunks, each chunk receives its own `dev_pagemap`. If segments from different maps are coalesced, the kernel cannot recover the correct `pgmap` via `page_pgmap()`. This has been resolved by adding a `zone_device_pages_have_same_pgmap()` check to prevent improper merging.
Affected products
- Linux Linux Kernel Fixed in versions 13920e4, 3d2ecbd, a7f3aa8, f17d521, f632dab
Timeline
- 2026-04-10: other: Patch authored
- 2026-05-28: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/13920e4b7b784b40cf4519ff1f0f3e513476a499
- https://git.kernel.org/stable/c/3d2ecbd444b01d6500671d1a582b7393943cf539
- https://git.kernel.org/stable/c/a7f3aa8c9df3905fe820ae36b67ba56b81587574
- https://git.kernel.org/stable/c/f17d521075325b8afc42d1baa1c28a5e9aca111f
- https://git.kernel.org/stable/c/f632dab4b841554cd6416058c61886d7db176581