Executive brief
The Linux kernel's block I/O subsystem did not properly validate user-supplied memory alignment before processing direct I/O requests. An attacker could provide misaligned memory vectors that bypass device DMA alignment checks, potentially causing data corruption, system crashes, or kernel panics when storage devices attempt to access improperly aligned memory regions.
Technical details
The vulnerability exists in the block layer's bio_iov_iter_get_pages() function, which constructs block I/O (bio) structures from user-space iov_iter vectors without validating alignment against the device's DMA alignment requirements. Bio-based and stacking block drivers may not detect misalignment after bio submission, leading to unsafe memory access. The fix adds a mem_align_mask parameter and validation checks via bio_iov_bvec_aligned() to reject misaligned vectors early with -EINVAL before the bio is submitted. The vulnerability was introduced by prior commits (5ff3f74e145a and 7eac33186957) that simplified direct I/O validity checks.
Affected products
- Linux Linux kernel Multiple stable branches from 2.6.11.y through 7.2.y
Timeline
- 2026-09-11: disclosed
- 2026-07-31: patched