CVE-2026-46115

In the Linux kernel, the following vulnerability has been resolved:

block: add pgmap check to biovecphysmergeable

biovecphysmergeable() is used by the request merge, DMA mapping,

and integrity merge paths to decide if two physically contiguous

bvec segments can be coalesced into one. It currently has no check

for whether the segments belong to different dev_pagemaps.

When zone device memory is registered in multiple chunks, each chunk

gets its own dev_pagemap. A single bio can legitimately contain

bvecs from different pgmaps -- ioviterextract_bvecs() breaks at

pgmap boundaries but the outer loop in bioiovitergetpages()

continues filling the same bio. If such bvecs are physically

contiguous, biovecphysmergeable() will coalesce them, making it

impossible to recover the correct pgmap for the merged segment

via page_pgmap().

Add a zonedevicepageshavesame_pgmap() check to prevent merging

bvec segments that span different pgmaps.