Executive brief
A vulnerability in the Linux kernel's NVMe storage driver could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue occurs when the system attempts to manage internal data buffers for NVMe drives, specifically during error handling or reset operations. This could impact the stability and data confidentiality of systems using NVMe-based storage.
Technical details
A slab-out-of-bounds read vulnerability exists in the nvme_dbbuf_set function within drivers/nvme/host/pci.c of the Linux kernel. The root cause is an off-by-one error in a loop condition where the code iterates up to and including dev->online_queues, while valid indices only extend to dev->online_queues - 1. This occurs during error cleanup when nvme_dbbuf_free is called for each queue. An attacker with local access could trigger this via specific NVMe reset or initialization sequences, leading to a KASAN-detected out-of-bounds access. Patches have been released across multiple stable kernel branches to correct the loop boundary.
Affected products
- Linux Linux Kernel 5.9.12 to 5.10, 5.11 to 5.15.203, 6.2 to 6.6.130
Timeline
- 2026-03-08: other: Vulnerability fix authored
- 2026-05-08: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71
- https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7
- https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9
- https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e
- https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f
- https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c
- https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516