SB20260912311 - Use of uninitialized resource in Linux kernel nvme host driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-89483)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the NVMe discard fallback page when processing discard commands. A local user can trigger a discard command that causes uninitialized DSM payload data to be sent to the controller to disclose sensitive information.

Exploitation requires the discard-range allocation to fail under memory pressure.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/67551d8430df94c827e1830bd3a5fae1f66a5219
• https://git.kernel.org/stable/c/bededeaaeff404978a5a8e2a605a6c3017cddd3e
• https://git.kernel.org/stable/c/dc4d4b70a863f7e39ef8bd137634be4e6db8b084
• https://git.kernel.org/stable/c/f5827817b4fc7feeabf4f53fb4b626e6edc52fef