Look up another CVE · open CVE-2026-93074 in the interactive tracker
CVE-2026-93074
dax/fsdev: use __va(phys) for kaddr in direct_access
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/dax. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-93074 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Use __va(phys) instead of virt_addr + linear_offset for the kaddr return in __fsdev_dax_direct_access(). The previous code added a device-linear byte offset to virt_addr (which is __va of ranges[0]), but for multi-range devices with physical gaps between ranges, this linear arithmetic crosses the gap and produces a wrong kernel virtual address. Using __va(phys) where phys comes from dax_pgoff_to_phys() is correct for any range layout because the direct map translates each physical address independently. This leaves dev_dax->virt_addr write-only, so remove the field (suggested by Dave Jiang).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/dax/dax-private.h
drivers/dax/fsdev.c
- What this is
- DEVICE DIRECT ACCESS (DAX)MAINTAINERS section matched on drivers/dax/ · nvdimm@lists.linux.dev · Supported
- Kernel module
- fsdev_dax
Check it on the machine
grep -w CONFIG_DEV_DAX_FSDEV /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w fsdev_daxPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidMnot built on amd64/rt-amd64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae
- ?
- not established - no Makefile entry for the affected file
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_DEV_DAX_FSDEV
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/dax
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.1 | 7.2.6 | 7b642bd3d391 |
| 7.1 | 7.3 | ff7c73fca793 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The wrong kaddr is computed in __fsdev_dax_direct_access() from a device pgoff supplied by dax_iomap_pgoff() during local VFS DAX I/O (dax_iomap_rw, dax_zero_iter, dax_fault_iter). No network protocol carries that pgoff.
- AC:LAttack complexity, low
- Once a gapped multi-range fsdev_dax device is bound, any I/O whose pgoff dax_pgoff_to_phys() places in a later range makes virt_addr+offset a deterministic wrong linear-map address; the attacker chooses the file offset that yields that pgoff, with no race.
- PR:LPrivileges required, low
- dax_match_type() never auto-binds DAXDRV_FSDEV_TYPE (admin new_id) and fs_dax_get() is the mount-time holder, but dax_direct_access() then has no capability check, so an unprivileged user with file access on the mounted FS-DAX tree reaches the bad kaddr via read/write/fallocate.
- UI:NUser interaction, none
- The attacker triggers the bad kaddr solely by their own read, write, fallocate, or page-fault on files they can already open; this is not attacker-supplied media that a victim must mount.
- S:UScope, unchanged
- dax_copy_from_iter(), dax_copy_to_iter(), and fsdev_write_dax() use the wrong host-kernel __va() pointer; impact stays in the host kernel and does not cross a KVM, IOMMU, or other VM-escape boundary.
- C:HConfidentiality impact, high
- dax_iomap_iter() calls dax_copy_to_iter() from virt_addr+offset, which for a later range is __va of the physical gap (another dax mapping in the same region, or System RAM), so a file read discloses that memory.
- I:HIntegrity impact, high
- dax_copy_from_iter() and fsdev_dax_zero_page_range()'s fsdev_write_dax() write attacker bytes or PAGE_SIZE zeros through the same wrong kaddr into the gap, giving a kernel write into adjacent DAX or RAM.
- A:HAvailability impact, high
- memcpy_flushcache() or copy through a kaddr that lands in an unmapped gap oopses the kernel; even a successful wrong-address write can panic by corrupting adjacent structures.