CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable

Synopsis

A memory-management flaw in the Linux kernel block layer allows physically contiguous bio-vector segments from different device-pagemap (dev_pagemap) chunks to be incorrectly merged. The vulnerability is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected system. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network, meaning an attacker must be able to send requests to the exposed service from a remote host.

• AuthenticationNot required

  No credentials or prior account access are needed to trigger the vulnerable code path (CVSS PR:N).

• Victim interactionNot required

  The exploit does not require any action from a logged-in user or administrator; it fires without social engineering (CVSS UI:N).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory-layout requirements (CVSS AC:L).

Blast Radius

• An attacker who exploits this flaw gains full read access to kernel memory regions, exposing stored credentials, session tokens, and sensitive in-flight data.
• The attacker can write to kernel memory structures, allowing modification of persisted data, privilege escalation, or injection of malicious code into kernel context.
• The incorrect pgmap resolution can corrupt I/O operations against zone device memory, crashing the affected service or rendering the block device unusable.
• Because the impact covers confidentiality, integrity, and availability at High severity across all three dimensions, a single exploitation event can simultaneously exfiltrate data, tamper with storage, and cause a system outage.