CVE-2026-74383
Description
A flaw was found in the NVMe-PCI subsystem of the Linux kernel. An out-of-bounds access can occur in the nvme_setup_descriptor_pools() function when handling Non-Uniform Memory Access (NUMA) node values on systems configured without NUMA support. This incorrect indexing can lead to a page fault, preventing the NVMe namespace from being properly initialized and resulting in a denial of service for the affected NVMe controller.
Statement
An out of bounds access in nvme_setup_descriptor_pools occurs because NUMA_NO_NODE (-1) from hctx numa_node is passed through an unsigned parameter and becomes UINT_MAX. On CONFIG_NUMA n kernels this indexes dev descriptor_pools far beyond the nr_node_ids sized array during NVMe namespace allocation, which can fault the kernel and leave the namespace without a device node. For the CVSS the PR:H is used for the base score because reliable triggering usually requires administrative control over NVMe probe, driver bind, reset, or hotplug paths. For the CVSS the PR:L is used for the paranoid score only if a less privileged local actor can indirectly force NVMe reprobe in a delegated environment. The issue is not network reachable and is tied to local hardware or local driver control. Impact is at least denial of service via kernel crash. Because the primitive is an out of bounds kernel access, limited confidentiality or integrity impact is kept in the paranoid score and the case should be reviewed manually.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
