From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05E0F4E3254 for ; Thu, 17 Sep 2026 16:37:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789663060; cv=none; b=kiowySxGg9cUhazT7wP+chAeHtuxBG5EV9b32TizCQiKodRZcNrNH8CyRVcRSo4c6wMwT9TMTsM8YRYghmKViUW5kTkaO54sLf0kgS6+Fc86NqwSQ+ABkKaEePZIMMKCxxBJA9zJx67TAh9cbQIR8uaBTUrno12HAAmFHZuTv0Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789663060; c=relaxed/simple; bh=ieCUPg/XAurxMje7A1qoTFLcWSfHrzwypoyHYVlOt9Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=J/WKzpS4R7PwMY2yHjT13ssdRnabJBPpppk2Rv/TL9wwdy0xY8l0YMjpjfwAv+sIKQtWwiwdCMkFY2EM0fGZrMhT/2wo6r5ASeErcbOSOGCUondETc/WUR/sRP/k5Z/wTNzT0moM147LVlmQcK12jL/wS4qNDrAgzFCDbuIjjbc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zuy57IWN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zuy57IWN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C7971F000FF; Thu, 17 Sep 2026 16:37:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789663058; bh=GG+cEIi0bZPE51FU49CTBR9WeAvOKQvIschUfSjVe2k=; h=From:To:Cc:Subject:Date:Reply-To; b=zuy57IWNEHEajS/aPqOTcbqJStQ/UP5E+mW6XKTy1dR4C8AK1t2zMmioUpvj6YPmw sg/o+qRYUuwTaxHBpQ3V17tOTjVHYu3z06GVvEYjf2YkZTes3oeos5I6gG1EoTn7JZ iBR46qxv0jVo3bt9DDWT0wKXcMI094GRmumI7+Ns= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-93075: dax/fsdev: clear pgmap ops and owner on unbind Date: Thu, 17 Sep 2026 17:15:54 +0100 Message-ID: <2026091740-CVE-2026-93075-785a@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2705; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=+d+ODSXKIBoO/uGEFm9zfL/20fsvIqk4Kx+rCANDBYE=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBI4Y9qT6LmURXZxkYXbpxhaJCf98+etMD17fH3tJj 3E/E7dORywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExkvy/DgukbbZ99XSbblK99 KkmPedqq45baegwLNk7SlJYK7LO8sjq3oc+UN185pK8AAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and pgmap->owner = dev_dax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this is harmless. For a static device the pgmap is the shared, long-lived one owned by the dax bus (kill_dev_dax() only NULLs dev_dax->pgmap for the non-static case), and device.c's probe sets only pgmap->type, never clearing ops/owner. So after fsdev unbinds a static device the stale fsdev_pagemap_ops survives on the shared pgmap. If the device is then rebound to device_dax (MEMORY_DEVICE_GENERIC, which installs no ->memory_failure), or the fsdev_dax module is unloaded, a subsequent memory_failure on that pgmap dispatches through the stale -- and possibly freed -- handler. Register a devm action that clears pgmap->ops and pgmap->owner on unbind, symmetric with setting them at probe, so the pgmap carries no fsdev state once fsdev is detached. The Linux kernel CVE team has assigned CVE-2026-93075 to this issue. Affected and fixed versions =========================== Issue introduced in 7.1 with commit d5406bd458b0ac10b1301a4d5801d85c8f648637 and fixed in 7.2.6 with commit 9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27 Issue introduced in 7.1 with commit d5406bd458b0ac10b1301a4d5801d85c8f648637 and fixed in 7.3-rc1 with commit f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-93075 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/dax/fsdev.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27 https://git.kernel.org/stable/c/f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7