Linux Distros Unpatched Vulnerability : CVE-2026-93074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code...

Linux Distros Unpatched Vulnerability : CVE-2026-93073

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for...

Linux Distros Unpatched Vulnerability : CVE-2026-93076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may...

Linux Distros Unpatched Vulnerability : CVE-2026-93075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a...

DEBIAN-CVE-2026-93076

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

DEBIAN-CVE-2026-93074

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-93076

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

DEBIAN-CVE-2026-93075

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this ...

CVE-2026-93074

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

EUVD-2026-82186

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

CVE-2026-93076

CVE-2026-93076 affects the Linux kernel 's DAX (Direct Access) driver subsystem, specifically the fsdev_dax path for static devices. When a static DAX device is rebound from device_dax to fsdev_dax , a stale vmemmap_shift value—set by device_dax based on alignment—persists on the shared pgmap str...

EUVD-2026-82184

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-93074 dax/fsdev: use __va(phys) for kaddr in direct_access

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-93075 dax/fsdev: clear pgmap ops and owner on unbind

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this ...

CVE-2026-93074

CVE-2026-93074 affects the Linux kernel 's dax/fsdev subsystem. The root cause is in __fsdev_dax_direct_access(), which computed the kernel virtual address by adding a device-linear byte offset to virt_addr (the direct-map address of ranges[0]). For multi-range devices with physical gaps between ...

CVE-2026-93074 dax/fsdev: use __va(phys) for kaddr in direct_access

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-93075 dax/fsdev: clear pgmap ops and owner on unbind

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this ...

CVE-2026-93075

CVE-2026-93075 is a Linux kernel vulnerability in the dax/fsdev subsystem. When fsdev_dax_probe() sets pgmap->ops and pgmap->owner, these fields are never cleared on unbind for static devices . Because the shared pgmap is long-lived (owned by the dax bus), stale fsdev_pagemap_ops persist af...

CVE-2026-93073

This TOCTOU race condition affects the Linux kernel DAX subsystem in the dax_holder_notify_failure() function. The function reads dax_dev->holder_ops twice without READ_ONCE()—once for a NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops ...

CVE-2026-93076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...