Executive brief
The Linux kernel's NVMe (NVM Express) PCI driver manages memory pools for disk I/O operations. On systems without NUMA support (non-NUMA kernels), an integer type mismatch causes the code to use an invalid array index, triggering a page fault and preventing NVMe drives from being accessible as block devices. This affects any system using NVMe storage without NUMA enabled.
Technical details
The vulnerability is an out-of-bounds array access caused by a type mismatch in the nvme_setup_descriptor_pools() function. On non-NUMA kernels, hctx->numa_node is set to NUMA_NO_NODE (-1). Because the parameter was declared as unsigned, the value -1 becomes UINT_MAX when passed as an unsigned argument, causing an array index walk-off in the dev->descriptor_pools[] array (sized to nr_node_ids). This triggers a page fault during nvme_alloc_ns() execution. The fix changes the parameter from unsigned to int and adds a fallback to node 0 when NUMA_NO_NODE is encountered, since node 0 is always present. Patch availability: fix committed upstream and backported to stable kernel series.
Affected products
- Linux Linux kernel multiple versions prior to fix (see upstream commit a192b8cfa447e1b3701a13434a31c392b2e7ed29)
Timeline
- 2026-08-15: disclosed: Published as CVE-2026-74383
- 2026-05-27: patched: Upstream fix committed by Keith Busch
- 2026-07-24: patched: Backported to stable kernel series by Greg Kroah-Hartman