CVE-2026-74383: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools
nvmesetupdescriptorpools() indexes dev->descriptorpools[] using the numanode forwarded from hctx->numanode by its single caller, nvmeinithctxcommon(). On a non-NUMA kernel hctx->numanode is NUMANONODE (-1). Because the parameter was declared 'unsigned', the value becomes UINTMAX and the index walks off the array (sized to nrnodeids), faulting during nvmeallocns() and leaving the namespace without a /dev node.
Reproduces on any NVMe controller probed by a CONFIGNUMA=n kernel:
BUG: unable to handle page fault for address: ffff889101603d38 RIP: 0010:nvmeinithctxcommon+0x5a/0x190 [nvme] Call Trace: nvmeinithctx+0x10/0x20 [nvme] nvmeallocns+0x9e/0xa10 [nvmecore] nvmescanns+0x301/0x3b0 [nvmecore] nvmescannsasync+0x23/0x30 [nvmecore]
Switch the parameter to int and fall back to node 0 when it is NUMANONODE; node 0 is always present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (nvme)to a version that resolves this vulnerability.Patch nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools - Configuration
When running a non-NUMA kernel (CONFIG_NUMA=n) and nvme_setup_descriptor_pools indexes descriptor_pools[], ensure hctx->numa_node does not take the NUMA_NO_NODE (-1) value; patch behavior should switch the parameter to int and fall back to node 0 when it is NUMA_NO_NODE (-1).
Linux kernel CONFIG_NUMA = n (non-NUMA kernel)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74383?
CVE-2026-74383 has been assigned a risk score of 27, indicating potential security implications.
How do I fix CVE-2026-74383?
To fix CVE-2026-74383, ensure you update your Linux kernel to the latest version that includes the patch.
What systems are affected by CVE-2026-74383?
CVE-2026-74383 affects systems utilizing the Linux kernel with the nvme-pci driver that have not incorporated the security fix.
What is the impact of CVE-2026-74383?
The impact of CVE-2026-74383 includes the potential for out-of-bounds access, which could lead to system instability or data corruption.
Is CVE-2026-74383 a critical vulnerability?
While CVE-2026-74383 poses risks, its severity should be evaluated in the context of specific system configurations and usage.