CVE-2026-93074: dax/fsdev: use __va(phys) for kaddr in direct_access

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

dax/fsdev: use va(phys) for kaddr in directaccess

Use va(phys) instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess(). The previous code added a device-linear byte offset to virtaddr (which is va of ranges[0]), but for multi-range devices with physical gaps between ranges, this linear arithmetic crosses the gap and produces a wrong kernel virtual address. Using va(phys) where phys comes from daxpgofftophys() is correct for any range layout because the direct map translates each physical address independently.

This leaves devdax->virtaddr write-only, so remove the field (suggested by Dave Jiang).

Event History

Sep 17, 2026
CVE Published
via MITRE·04:10 PM
Data Sourced
via MITRE·04:10 PM
Description

Frequently Asked Questions

1

Which systems are exposed to the incorrect address calculation?

Systems using fsdev DAX with a device that has multiple physical ranges separated by gaps are exposed. The incorrect arithmetic can produce a kernel virtual address that crosses a physical gap.

2

What condition triggers the faulty mapping?

A direct-access operation must resolve an offset into a later physical range on a multi-range device with gaps. The previous implementation derived the address by adding a linear device offset to the first range's virtual address instead of translating the resolved physical address independently.

3

How can I determine whether the fix is present?

Check whether __fsdev_dax_direct_access() returns kaddr using __va(phys), with phys obtained from dax_pgoff_to_phys(). The fix also removes the dev_dax->virt_addr field because it is no longer needed for reads.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203