SB2026081568 - Out-of-bounds read in Linux kernel nvme host driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-74383)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in nvme_setup_descriptor_pools when initializing NVMe hardware contexts on systems built without NUMA support. A local user can trigger NVMe namespace initialization to cause a denial of service.

The issue occurs because a NUMA node value of -1 is treated as an unsigned array index, which can fault during nvme_alloc_ns() and leave the namespace without a /dev node.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3e8aed5edaeeb237f97255d711aac6b5843fc059
• https://git.kernel.org/stable/c/a192b8cfa447e1b3701a13434a31c392b2e7ed29
• https://git.kernel.org/stable/c/fa9b6accd1ad7af6914b409c6b003c417724c299