Executive brief
The Linux kernel's DAX (Direct Access) filesystem driver failed to clear a memory mapping configuration value when rebinding storage devices between driver modes. This could cause the kernel to incorrectly manage memory pages for filesystem-based DAX operations, potentially leading to data corruption or system instability on systems using persistent memory or NVMe storage with DAX.
Technical details
The vulnerability is a state-management bug in drivers/dax/fsdev.c where the pgmap->vmemmap_shift field was not cleared when transitioning a static DAX device from device_dax mode to fsdev_dax mode. When a device is rebound, the stale vmemmap_shift value (set by the previous driver based on alignment) persists on the shared pgmap structure. This causes devm_memremap_pages() to build the virtual memory mapping incorrectly, using larger folio orders instead of the order-0 folios required by fsdev. The fix adds a single line to explicitly zero pgmap->vmemmap_shift before rebinding. No authentication or user interaction is required; the bug manifests during normal device rebinding operations on affected systems.
Affected products
- Linux Linux kernel Multiple versions (see kernel.org stable branches)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-06-15: patched: Upstream patch committed by John Groves
- 2026-07-14: patched: Stable commit e0239229931faf9ca3367e3befcf16f77b2cd45b