CVE-2026-93076: dax/fsdev: clear vmemmap_shift when binding static pgmap
In the Linux kernel, the following vulnerability has been resolved:
dax/fsdev: clear vmemmapshift when binding static pgmap
Clear pgmap->vmemmapshift for static DAX devices. When rebinding a static device from devicedax (which may set vmemmapshift based on alignment) to fsdevdax, the stale vmemmapshift persists on the shared pgmap. Explicitly zero it before devmmemremappages() so the vmemmap is built for order-0 folios as fsdev requires.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to static DAX devices that are rebound from device_dax to fsdev_dax while sharing the same pgmap. Systems that do not perform this rebinding scenario are not described as affected.
What condition is required to trigger the problem?
A static device must previously have been used with device_dax, where vmemmap_shift may be set based on alignment, and then be rebound to fsdev_dax. The stale value must remain on the shared pgmap when fsdev_dax calls devm_memremap_pages().
What is the immediate mitigation if the fix cannot be applied?
Avoid rebinding static DAX devices from device_dax to fsdev_dax. This prevents a vmemmap_shift value set for device_dax from being reused by fsdev_dax.
How can I determine whether a system may already be affected?
Review static DAX device lifecycle and configuration for devices that have transitioned from device_dax to fsdev_dax. The relevant condition is a shared pgmap retaining a nonzero vmemmap_shift before fsdev_dax initializes memory mappings.