Linux Kernel up to 7.2.5 Dax Fsdev dax/fsdev __fsdev_dax_direct_access memory corruption

Summaryinfo

A vulnerability described as very critical has been identified in Linux Kernel up to 7.2.5. The impacted element is the function __fsdev_dax_direct_access of the file dax/fsdev of the component Dax Fsdev. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2026-93074. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.5. Affected by this issue is the function __fsdev_dax_direct_access of the file dax/fsdev of the component Dax Fsdev. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use __va(phys) for kaddr in direct_access Use __va(phys) instead of virt_addr + linear_offset for the kaddr return in __fsdev_dax_direct_access(). The previous code added a device-linear byte offset to virt_addr (which is __va of ranges[0]), but for multi-range devices with physical gaps between ranges, this linear arithmetic crosses the gap and produces a wrong kernel virtual address. Using __va(phys) where phys comes from dax_pgoff_to_phys() is correct for any range layout because the direct map translates each physical address independently. This leaves dev_dax->virt_addr write-only, so remove the field (suggested by Dave Jiang).

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-93074 since 09/17/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/17/2026).

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 7b642bd3d39105eef4d5908970726c5fda291b53/ff7c73fca793bd5c29a15ba735b0886f62f3a840 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion