Executive brief
The Linux kernel's DAX (Direct Access) filesystem device driver miscalculates kernel virtual addresses when accessing memory regions with physical gaps on multi-range devices. This incorrect address translation can cause the kernel to access wrong memory locations, potentially leading to data corruption, system crashes, or information disclosure when applications use DAX-enabled persistent memory.
Technical details
The vulnerability exists in the __fsdev_dax_direct_access() function in drivers/dax/fsdev.c. The code incorrectly computed kernel virtual addresses by adding a device-linear byte offset to a base virtual address, rather than translating the actual physical address. For multi-range DAX devices with physical gaps between ranges, this linear arithmetic would cross the gap and produce an incorrect kernel virtual address (kaddr). The fix replaces the flawed offset calculation with __va(phys), which correctly translates each physical address independently through the kernel's direct map. This is a kernel-level memory management bug affecting DAX-capable systems with multi-range persistent memory configurations. The vulnerability was patched in upstream Linux and backported to stable kernel branches.
Affected products
- Linux Linux kernel various versions prior to fix commit ff7c73fca793bd5c29a15ba735b0886f62f3a840
Timeline
- 2026-09-17: disclosed: CVE-2026-93074 published
- 2026-06-15: patched: Fix committed upstream by John Groves
- 2026-09-14: patched: Backported to stable kernel branches by Greg Kroah-Hartman