CVE-2026-74383: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools
nvmesetupdescriptorpools() indexes dev->descriptorpools[] using the numanode forwarded from hctx->numanode by its single caller, nvmeinithctxcommon(). On a non-NUMA kernel hctx->numanode is NUMANONODE (-1). Because the parameter was declared 'unsigned', the value becomes UINTMAX and the index walks off the array (sized to nrnodeids), faulting during nvmeallocns() and leaving the namespace without a /dev node.
Reproduces on any NVMe controller probed by a CONFIGNUMA=n kernel:
BUG: unable to handle page fault for address: ffff889101603d38 RIP: 0010:nvmeinithctxcommon+0x5a/0x190 [nvme] Call Trace: nvmeinithctx+0x10/0x20 [nvme] nvmeallocns+0x9e/0xa10 [nvmecore] nvmescanns+0x301/0x3b0 [nvmecore] nvmescannsasync+0x23/0x30 [nvmecore]
Switch the parameter to int and fall back to node 0 when it is NUMANONODE; node 0 is always present.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (nvme)to a version that resolves this vulnerability.Patch nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools - Configuration
When running a non-NUMA kernel (CONFIG_NUMA=n) and nvme_setup_descriptor_pools indexes descriptor_pools[], ensure hctx->numa_node does not take the NUMA_NO_NODE (-1) value; patch behavior should switch the parameter to int and fall back to node 0 when it is NUMA_NO_NODE (-1).
Linux kernel CONFIG_NUMA = n (non-NUMA kernel)