Executive brief
The Linux kernel's NVMe storage multipath driver incorrectly allocates memory for NUMA node lookups on systems with non-sequential node IDs (common on PowerPC). An attacker with kernel-level access can trigger out-of-bounds memory writes by accessing NVMe devices on these systems, potentially leading to kernel crashes, privilege escalation, or arbitrary code execution.
Technical details
This is a buffer overflow vulnerability in the nvme-multipath kernel module's nvme_ns_head structure. The flexible array member current_path[] is sized using num_possible_nodes(), which returns the count of possible NUMA nodes rather than the maximum node ID. On systems with sparse NUMA node IDs (e.g., PowerPC with node IDs 0, 8, 252–255 but only 6 total nodes), indexing with the actual NUMA node ID exceeds the allocated buffer. The vulnerability is triggered when nvme_mpath_revalidate_paths() attempts to write to an out-of-bounds array element. An attacker with the ability to initiate NVMe device probing or namespace scanning can trigger this code path, causing a kernel crash (denial of service) or potentially privilege escalation. The fix changes the allocation to use nr_node_ids, which represents the maximum possible node ID, ensuring the array is large enough for sparse configurations.
Affected products
- Linux Linux kernel 7.1.0-rc5 and earlier versions
Timeline
- 2026-08-15: disclosed