Use of uninitialized resource in Linux kernel - CVE-2026-89483

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the NVMe discard fallback page when processing discard commands. A local user can trigger a discard command that causes uninitialized DSM payload data to be sent to the controller to disclose sensitive information.

Exploitation requires the discard-range allocation to fail under memory pressure.

Affected software

How to mitigate CVE-2026-89483

External References

• https://git.kernel.org/stable/c/67551d8430df94c827e1830bd3a5fae1f66a5219
• https://git.kernel.org/stable/c/bededeaaeff404978a5a8e2a605a6c3017cddd3e
• https://git.kernel.org/stable/c/dc4d4b70a863f7e39ef8bd137634be4e6db8b084
• https://git.kernel.org/stable/c/f5827817b4fc7feeabf4f53fb4b626e6edc52fef

Related Security Bulletins

• Use of uninitialized resource in Linux kernel nvme host driver