KernelScan.io

HIGH Introduced in 6.18

block DmaAlignment Corruption

CVE-2026-89584

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI7.8HIGH

01

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dma_alignment as the bio is built from the iov_iter, rejecting misaligned early with -EINVAL.

02

Engine v0.6.0

Risk summary

A local user can submit direct I/O with buffers misaligned to the target device's DMA requirements. Because the block layer no longer validates alignment early, the misaligned bio may reach a driver or device that does not handle it correctly, leading to memory corruption, data corruption, or a kernel panic. Any system allowing untrusted local users to perform direct I/O to block devices or iomap-backed filesystems is at risk.

Affectedblock/bio.c, block/fops.c, fs/iomap/direct-io.c, lib/iov_iter.c (block layer)

Vulnerability analysis

When a process issues direct I/O, the kernel builds a block-I/O request from the user-supplied memory buffer without checking that the buffer address and length meet the target device's DMA alignment requirements. An earlier change removed the early alignment check and deferred it to the block layer, but device drivers and stacking drivers do not always catch misalignment after the request is submitted, so a misaligned request can reach the hardware and cause incorrect DMA transfers, memory corruption, or crashes. The fix restores alignment validation while the request is being assembled: the device alignment requirement is checked as pages are extracted from the user's buffer, and any misaligned buffer is rejected before the request is sent to the driver. Any local user with access to a block device or a filesystem that supports direct I/O can trigger this; no special privileges or hardware configuration are needed beyond opening the device or file with the direct-I/O flag.

03

BranchIntroducedFixed inPatch commit
mainline6.187.3-rc114b007e17881
7.26.187.2.4d44a97a3b1c0