CVE-2026-93075: dax/fsdev: clear pgmap ops and owner on unbind

CVE-2026-93075: dax/fsdev: clear pgmap ops and owner on unbind

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dax/fsdev: clear pgmap ops and owner on unbind

fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and
pgmap->owner = dev_dax, but nothing ever clears them. For a dynamic
device the pgmap is devm-allocated and freed on unbind, so this is
harmless. For a static device the pgmap is the shared, long-lived one
owned by the dax bus (kill_dev_dax() only NULLs dev_dax->pgmap for the
non-static case), and device.c's probe sets only pgmap->type, never
clearing ops/owner.

So after fsdev unbinds a static device the stale fsdev_pagemap_ops
survives on the shared pgmap. If the device is then rebound to
device_dax (MEMORY_DEVICE_GENERIC, which installs no ->memory_failure),
or the fsdev_dax module is unloaded, a subsequent memory_failure on that
pgmap dispatches through the stale -- and possibly freed -- handler.

Register a devm action that clears pgmap->ops and pgmap->owner on unbind,
symmetric with setting them at probe, so the pgmap carries no fsdev state
once fsdev is detached.

The Linux kernel CVE team has assigned CVE-2026-93075 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.1 with commit d5406bd458b0ac10b1301a4d5801d85c8f648637 and fixed in 7.2.6 with commit 9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27
	Issue introduced in 7.1 with commit d5406bd458b0ac10b1301a4d5801d85c8f648637 and fixed in 7.3-rc1 with commit f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-93075
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/dax/fsdev.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27
	https://git.kernel.org/stable/c/f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7