CVE-2026-46115

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: add pgmap check to biovec_phys_mergeable

biovec_phys_mergeable() is used by the request merge, DMA mapping,

and integrity merge paths to decide if two physically contiguous

bvec segments can be coalesced into one. It currently has no check

for whether the segments belong to different dev_pagemaps.

When zone device memory is registered in multiple chunks, each chunk

gets its own dev_pagemap. A single bio can legitimately contain

bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at

pgmap boundaries but the outer loop in bio_iov_iter_get_pages()

continues filling the same bio. If such bvecs are physically

contiguous, biovec_phys_mergeable() will coalesce them, making it

impossible to recover the correct pgmap for the merged segment

via page_pgmap().

Add a zone_device_pages_have_same_pgmap() check to prevent merging

bvec segments that span different pgmaps.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References