Executive brief
The Linux kernel's BTT (Block Translation Table) subsystem for managing non-volatile memory devices fails to validate the nfree field during arena discovery. An attacker with physical access to a crafted storage device or the ability to present a malicious BTT info block can trigger an out-of-bounds write to kernel memory, potentially causing system crash or code execution.
Technical details
The vulnerability is a buffer over-read/over-write in the nvdimm/btt subsystem's arena discovery code. The BTT info block's nfree field (number of reserve free blocks) is read from storage without validation, and used to size per-lane freelist[] and rtt[] arrays. However, the I/O path indexes these arrays using lane IDs bounded by nd_region->num_lanes (up to ND_MAX_LANES), not by nfree. If nfree is smaller than num_lanes, indexing freelist[lane] or rtt[lane] causes an out-of-bounds write. The fix enforces the documented invariant nlanes = min(nfree, num_cpus) by rejecting arenas where nfree < num_lanes during discovery. Exploitation requires presenting a crafted or foreign BTT arena (physical storage access or local root), but no user interaction is required once the device is connected.
Affected products
- Linux Linux kernel Linux 5.2 through 6.x (all versions prior to patch)
Timeline
- 2026-09-16: disclosed: Public advisory released
- 2026-07-14: patched: Patch merged upstream (commit 6a1f2e5ed9267ca19187038ac635393c165213ac)
- 2026-09-14: patched: Backported to stable kernel trees (commit 59d5cd1f42b4bab3609512c3cb3d3540d3d21da7)