CVE-2026-46115 Overview
CVE-2026-46115 is a Linux kernel block layer vulnerability in the biovec_phys_mergeable() function. The function decides whether two physically contiguous bvec segments can be coalesced into a single segment during request merging, DMA mapping, and integrity merge operations. It did not verify that adjacent segments belonged to the same dev_pagemap. When zone device memory spans multiple dev_pagemap chunks, a single bio can carry bvecs from different pgmaps, and incorrect coalescing prevents recovery of the correct pgmap via page_pgmap(). The fix introduces a zone_device_pages_have_same_pgmap() check to block merging across pgmap boundaries.
Critical Impact
Incorrect coalescing of bvec segments across distinct dev_pagemap regions can corrupt zone device I/O accounting and break pgmap-dependent code paths in the block layer.
Affected Products
- Linux kernel block subsystem (block/ layer using biovec_phys_mergeable())
- Systems exposing zone device memory registered in multiple dev_pagemap chunks
- Kernel paths using iov_iter_extract_bvecs() and bio_iov_iter_get_pages()
Discovery Timeline
- 2026-05-28 - CVE-2026-46115 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46115
Vulnerability Analysis
The biovec_phys_mergeable() helper inspects two bio_vec segments and reports whether they are physically contiguous and may be merged. The block layer relies on this answer in three hot paths: request merging, DMA mapping, and integrity merging. Before the fix, the function compared only physical addresses and did not consult the dev_pagemap associated with each page. Two segments could therefore appear mergeable even when they originated from different dev_pagemap instances.
Root Cause
Zone device memory may be registered in multiple chunks, with each chunk owning a distinct dev_pagemap. The helper iov_iter_extract_bvecs() breaks bvec extraction at pgmap boundaries, but the outer loop in bio_iov_iter_get_pages() keeps filling the same bio. The result is a single bio whose bvecs legitimately reference pages owned by different pgmaps. Without a pgmap-equality test, biovec_phys_mergeable() collapses such bvecs into one segment, after which page_pgmap() cannot recover the correct pgmap for the merged range.
Attack Vector
This is a kernel correctness defect in the block layer rather than a remote attack primitive. Exploitation requires workloads that issue I/O against zone device memory registered as multiple dev_pagemap chunks, such as systems using device DAX or persistent memory split across regions. Triggering the condition depends on bio submission patterns and kernel configuration. The vulnerability category is best described as a kernel block layer logic error affecting data integrity and pgmap tracking.
No verified public exploit or proof-of-concept is available. See the upstream commits for the technical fix: Kernel commit 13920e4, Kernel commit 3d2ecbd, Kernel commit a7f3aa8, Kernel commit f17d521, and Kernel commit f632dab.
Detection Methods for CVE-2026-46115
Indicators of Compromise
- Kernel warnings or oops messages referencing page_pgmap, biovec_phys_mergeable, or dev_pagemap during I/O on zone device memory.
- Block layer I/O errors or integrity verification failures on systems backed by multiple dev_pagemap regions.
- Unexpected DMA mapping faults on workloads using device DAX or persistent memory.
Detection Strategies
- Inventory hosts running kernels that include biovec_phys_mergeable() without the pgmap check by comparing build versions against the upstream stable commit list.
- Monitor dmesg and kernel telemetry for new warnings emitted along block submission paths after enabling zone device memory.
- Audit storage configurations to identify systems exposing multi-chunk dev_pagemap setups, which are the prerequisite for triggering the bug.
Monitoring Recommendations
- Forward kernel logs to a central log store and alert on WARN_ON or BUG events in block/bio.c and block/blk-merge.c.
- Track stable kernel release versions across the Linux fleet and flag hosts lagging behind patched builds.
- Correlate storage I/O error spikes with workloads that target zone device or persistent memory backends.
How to Mitigate CVE-2026-46115
Immediate Actions Required
- Identify Linux hosts running affected kernel versions, prioritizing systems that expose zone device memory or persistent memory.
- Apply the latest stable kernel update from your distribution that incorporates the upstream pgmap check.
- Validate boot and storage stack functionality on a representative host before broad rollout.
Patch Information
The upstream fix adds a zone_device_pages_have_same_pgmap() check inside biovec_phys_mergeable() so that bvec segments from different dev_pagemap instances are no longer coalesced. The change is available in the following stable commits: 13920e4, 3d2ecbd, a7f3aa8, f17d521, and f632dab. Rebuild and reboot affected systems after applying the corresponding distribution package.
Workarounds
- Avoid registering zone device memory in multiple dev_pagemap chunks on unpatched kernels where the workload allows a single contiguous region.
- Restrict workloads that submit large bios against device DAX or persistent memory until patched kernels are deployed.
- Track distribution security advisories and schedule kernel updates as soon as backported builds become available.
# Verify the running kernel against patched stable commits
uname -r
rpm -q kernel || dpkg -l | grep linux-image
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
