The flaw lies in the Linux kernel function biovec_phys_mergeable(), which is used for merging contiguous bvec segments during request merge, DMA mapping, and integrity merge paths. It does not verify if the segments belong to the same dev_pagemap. If a single bio contains bvecs from different pagemaps that happen to be physically contiguous, the function will merge them, resulting in a merged segment whose underlying pgmap cannot be recovered accurately via page_pgmap(). This logical oversight can lead to memory corruption or leakage of data that should be protected by the original pagemap boundaries.

Affected systems include all Linux kernel versions prior to the patch that adds the pgmap boundary check. The vulnerability arises when zone device memory is registered in multiple chunks, each creating a distinct dev_pagemap. Any Linux system that uses such zone device memory is susceptible, regardless of distribution.

The risk profile is significant because the flaw resides in kernel core memory handling. While the EPSS score is not available and the vulnerability is not currently listed in CISA KEV, the lack of these metrics does not mitigate the potential for an attack. A local user with the ability to manipulate device memory mappings could craft bvecs that cross pagemap boundaries, leading to corruption or privileged information exposure. The recommended mitigation is a kernel update that incorporates the check added by commit 13920e4b7b784b40cf4519ff1f0f3e513476a499.