{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46115", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.098Z", "datePublished": "2026-05-28T09:35:26.735Z", "dateUpdated": "2026-05-28T09:35:26.735Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-28T09:35:26.735Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: add pgmap check to biovec_phys_mergeable\n\nbiovec_phys_mergeable() is used by the request merge, DMA mapping,\nand integrity merge paths to decide if two physically contiguous\nbvec segments can be coalesced into one. It currently has no check\nfor whether the segments belong to different dev_pagemaps.\n\nWhen zone device memory is registered in multiple chunks, each chunk\ngets its own dev_pagemap. A single bio can legitimately contain\nbvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at\npgmap boundaries but the outer loop in bio_iov_iter_get_pages()\ncontinues filling the same bio. If such bvecs are physically\ncontiguous, biovec_phys_mergeable() will coalesce them, making it\nimpossible to recover the correct pgmap for the merged segment\nvia page_pgmap().\n\nAdd a zone_device_pages_have_same_pgmap() check to prevent merging\nbvec segments that span different pgmaps."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk.h"], "versions": [{"version": "49580e690755d0e51ed7aa2c33225dd884fa738a", "lessThan": "3d2ecbd444b01d6500671d1a582b7393943cf539", "status": "affected", "versionType": "git"}, {"version": "49580e690755d0e51ed7aa2c33225dd884fa738a", "lessThan": "a7f3aa8c9df3905fe820ae36b67ba56b81587574", "status": "affected", "versionType": "git"}, {"version": "49580e690755d0e51ed7aa2c33225dd884fa738a", "lessThan": "f17d521075325b8afc42d1baa1c28a5e9aca111f", "status": "affected", "versionType": "git"}, {"version": "49580e690755d0e51ed7aa2c33225dd884fa738a", "lessThan": "f632dab4b841554cd6416058c61886d7db176581", "status": "affected", "versionType": "git"}, {"version": "49580e690755d0e51ed7aa2c33225dd884fa738a", "lessThan": "13920e4b7b784b40cf4519ff1f0f3e513476a499", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk.h"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.1-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3d2ecbd444b01d6500671d1a582b7393943cf539"}, {"url": "https://git.kernel.org/stable/c/a7f3aa8c9df3905fe820ae36b67ba56b81587574"}, {"url": "https://git.kernel.org/stable/c/f17d521075325b8afc42d1baa1c28a5e9aca111f"}, {"url": "https://git.kernel.org/stable/c/f632dab4b841554cd6416058c61886d7db176581"}, {"url": "https://git.kernel.org/stable/c/13920e4b7b784b40cf4519ff1f0f3e513476a499"}], "title": "block: add pgmap check to biovec_phys_mergeable", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: add pgmap check to biovec_phys_mergeable\n\nbiovec_phys_mergeable() is used by the request merge, DMA mapping,\nand integrity merge paths to decide if two physically contiguous\nbvec segments can be coalesced into one. It currently has no check\nfor whether the segments belong to different dev_pagemaps.\n\nWhen zone device memory is registered in multiple chunks, each chunk\ngets its own dev_pagemap. A single bio can legitimately contain\nbvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at\npgmap boundaries but the outer loop in bio_iov_iter_get_pages()\ncontinues filling the same bio. If such bvecs are physically\ncontiguous, biovec_phys_mergeable() will coalesce them, making it\nimpossible to recover the correct pgmap for the merged segment\nvia page_pgmap().\n\nAdd a zone_device_pages_have_same_pgmap() check to prevent merging\nbvec segments that span different pgmaps."}], "id": "CVE-2026-46115", "lastModified": "2026-05-28T13:44:01.663", "metrics": {}, "published": "2026-05-28T10:16:26.980", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/13920e4b7b784b40cf4519ff1f0f3e513476a499"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d2ecbd444b01d6500671d1a582b7393943cf539"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7f3aa8c9df3905fe820ae36b67ba56b81587574"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f17d521075325b8afc42d1baa1c28a5e9aca111f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f632dab4b841554cd6416058c61886d7db176581"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49580e690755d0e51ed7aa2c33225dd884fa738a,3d2ecbd444b01d6500671d1a582b7393943cf539)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49580e690755d0e51ed7aa2c33225dd884fa738a,a7f3aa8c9df3905fe820ae36b67ba56b81587574)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49580e690755d0e51ed7aa2c33225dd884fa738a,f17d521075325b8afc42d1baa1c28a5e9aca111f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49580e690755d0e51ed7aa2c33225dd884fa738a,f632dab4b841554cd6416058c61886d7db176581)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49580e690755d0e51ed7aa2c33225dd884fa738a,13920e4b7b784b40cf4519ff1f0f3e513476a499)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T11:30:15.486539+00:00", "title": "Kernel Pagemap Boundary Merge Bug Allows Improper Coalescing of Contiguous Bvec Segments", "updated": "2026-05-28T12:15:19.720326+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-456", "CWE-285"]}