---
id: CVE-2026-93075
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dax/fsdev: clear pgmap ops and owner on unbind

  fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and
  pgmap->owner = dev_dax, but nothing ever clears them
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dax/fsdev: clear pgmap ops and owner on unbind

  fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and
  pgmap->owner = dev_dax, but nothing ever clears them. For a d…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d5406bd458b0ac10b1301a4d5801d85c8f648637 <
    9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27
  - >-
    Linux >= d5406bd458b0ac10b1301a4d5801d85c8f648637 <
    f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7
  - Linux 7.1
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:01.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93075'
references:
  - url: 'https://git.kernel.org/stable/c/9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.763Z'
epss: 0.00155
epssPercentile: 0.0508
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dax/fsdev: clear pgmap ops and owner on unbind

fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and
pgmap->owner = dev_dax, but nothing ever clears them. For a dynamic
device the pgmap is devm-allocated and freed on unbind, so this is
harmless. For a static device the pgmap is the shared, long-lived one
owned by the dax bus (kill_dev_dax() only NULLs dev_dax->pgmap for the
non-static case), and device.c's probe sets only pgmap->type, never
clearing ops/owner.

So after fsdev unbinds a static device the stale fsdev_pagemap_ops
survives on the shared pgmap. If the device is then rebound to
device_dax (MEMORY_DEVICE_GENERIC, which installs no ->memory_failure),
or the fsdev_dax module is unloaded, a subsequent memory_failure on that
pgmap dispatches through the stale -- and possibly freed -- handler.

Register a devm action that clears pgmap->ops and pgmap->owner on unbind,
symmetric with setting them at probe, so the pgmap carries no fsdev state
once fsdev is detached.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.