Junglewise Threat Intelligence

CVE-2026-23244: Linux Kernel NVMe out-of-bounds read in nvme_pr_read_keys

CVE-2026-23244 · Severity: high · CVSS 7.1 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's NVMe driver could allow a local user to trigger system instability or potentially access sensitive information. The issue occurs when the system handles specific storage commands (Persistent Reservations) and fails to properly manage memory for large requests. This could lead to a system crash or unauthorized data reading by a malicious actor with local access.

Technical details

A vulnerability exists in the Linux kernel NVMe driver's nvme_pr_read_keys() function due to improper memory allocation handling. The function takes a 'num_keys' value from userspace to calculate allocation size via struct_size(), with a maximum limit of 64K (PR_KEYS_MAX). A large value can result in a 4MB allocation attempt using kzalloc(), which triggers a page allocator warning when the allocation order exceeds MAX_PAGE_ORDER. This can lead to an out-of-bounds read (CWE-125) or local denial of service. The fix replaces kzalloc() with kvzalloc() to properly handle larger contiguous memory requirements.

Affected products

  • Linux Linux Kernel 6.5.1 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1 to 7.0-rc2

Timeline

  • 2026-03-18: advisory: Initial disclosure of CVE-2026-23244
  • 2026-03-13: patched: Fix committed to stable branches by Greg Kroah-Hartman

References

Related threats