GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74383 (GCVE-0-2026-74383)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] using the numa_node forwarded from hctx->numa_node by its single caller, nvme_init_hctx_common(). On a non-NUMA kernel hctx->numa_node is NUMA_NO_NODE (-1). Because the parameter was declared 'unsigned', the value becomes UINT_MAX and the index walks off the array (sized to nr_node_ids), faulting during nvme_alloc_ns() and leaving the namespace without a /dev node. Reproduces on any NVMe controller probed by a CONFIG_NUMA=n kernel: BUG: unable to handle page fault for address: ffff889101603d38 RIP: 0010:nvme_init_hctx_common+0x5a/0x190 [nvme] Call Trace: nvme_init_hctx+0x10/0x20 [nvme] nvme_alloc_ns+0x9e/0xa10 [nvme_core] nvme_scan_ns+0x301/0x3b0 [nvme_core] nvme_scan_ns_async+0x23/0x30 [nvme_core] Switch the parameter to int and fall back to node 0 when it is NUMA_NO_NODE; node 0 is always present.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d977506f8863807129d7a11f4057dfb1b38085ea , < 3e8aed5edaeeb237f97255d711aac6b5843fc059 (git)
Affected: d977506f8863807129d7a11f4057dfb1b38085ea , < fa9b6accd1ad7af6914b409c6b003c417724c299 (git)
Affected: d977506f8863807129d7a11f4057dfb1b38085ea , < a192b8cfa447e1b3701a13434a31c392b2e7ed29 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e8aed5edaeeb237f97255d711aac6b5843fc059",
              "status": "affected",
              "version": "d977506f8863807129d7a11f4057dfb1b38085ea",
              "versionType": "git"
            },
            {
              "lessThan": "fa9b6accd1ad7af6914b409c6b003c417724c299",
              "status": "affected",
              "version": "d977506f8863807129d7a11f4057dfb1b38085ea",
              "versionType": "git"
            },
            {
              "lessThan": "a192b8cfa447e1b3701a13434a31c392b2e7ed29",
              "status": "affected",
              "version": "d977506f8863807129d7a11f4057dfb1b38085ea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools\n\nnvme_setup_descriptor_pools() indexes dev-\u003edescriptor_pools[] using the\nnuma_node forwarded from hctx-\u003enuma_node by its single caller,\nnvme_init_hctx_common().  On a non-NUMA kernel hctx-\u003enuma_node is\nNUMA_NO_NODE (-1).  Because the parameter was declared \u0027unsigned\u0027, the\nvalue becomes UINT_MAX and the index walks off the array (sized to\nnr_node_ids), faulting during nvme_alloc_ns() and leaving the namespace\nwithout a /dev node.\n\nReproduces on any NVMe controller probed by a CONFIG_NUMA=n kernel:\n\n  BUG: unable to handle page fault for address: ffff889101603d38\n  RIP: 0010:nvme_init_hctx_common+0x5a/0x190 [nvme]\n  Call Trace:\n   nvme_init_hctx+0x10/0x20 [nvme]\n   nvme_alloc_ns+0x9e/0xa10 [nvme_core]\n   nvme_scan_ns+0x301/0x3b0 [nvme_core]\n   nvme_scan_ns_async+0x23/0x30 [nvme_core]\n\nSwitch the parameter to int and fall back to node 0 when it is\nNUMA_NO_NODE; node 0 is always present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the nvme-pci host driver and is reached during local PCIe NVMe controller probe and namespace scan (nvme_probe/nvme_scan_work\u2192nvme_alloc_ns\u2192blk_mq_alloc_disk\u2192nvme_init_hctx_common), including rescan via NVME_IOCTL_RESCAN/sysfs and AER NS_CHANGED events from a locally attached device; there is no network-facing entry point.\nAC:L - On CONFIG_NUMA=n kernels, hctx-\u003enuma_node is always NUMA_NO_NODE, so the unsigned wrap to UINT_MAX and subsequent out-of-bounds access occur deterministically the first time any namespace hardware context is initialized for a probed NVMe controller, without races or attacker-influenced memory layout.\nPR:N - Exploitation requires no host OS credentials: any locally attached PCIe NVMe controller (boot-present, hot-plugged, supply-chain, or kiosk/shared-workstation storage) triggers the vulnerable scan during probe or when device firmware delivers a namespace-changed async event, without CAP_SYS_ADMIN or other privileges.\nUI:N - Triggering the bug does not require any victim user action such as mounting a filesystem or opening a device node; namespace scanning runs automatically from driver probe, controller rescan, or device-generated AER notifications handled entirely in kernel workqueues.\nS:U - Impact is confined to kernel memory corruption and crash within the host kernel NVMe/PCI driver security domain; it does not cross a VM, container, or IOMMU boundary to compromise a separate security authority.\nC:H - The vulnerable code performs an out-of-bounds read of descriptor_pools[UINT_MAX] (checking pools-\u003esmall) far beyond the nr_node_ids-sized allocation, constituting an unbounded kernel memory read that can disclose adjacent kernel data if the access does not immediately fault.\nI:H - The same out-of-bounds index would be used for dma_pool_create_node writes to pools-\u003elarge and pools-\u003esmall, giving an out-of-bounds kernel write primitive; even when the fault occurs on the initial read, this is exploitable-class memory corruption rather than a benign NULL dereference.\nA:H - The reported reproducer causes a kernel page fault in nvme_init_hctx_common during nvme_alloc_ns, producing an oops that aborts namespace creation and can panic the system, denying storage availability on CONFIG_NUMA=n hosts with NVMe controllers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:33.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e8aed5edaeeb237f97255d711aac6b5843fc059"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa9b6accd1ad7af6914b409c6b003c417724c299"
        },
        {
          "url": "https://git.kernel.org/stable/c/a192b8cfa447e1b3701a13434a31c392b2e7ed29"
        }
      ],
      "title": "nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74383",
    "datePublished": "2026-08-15T05:58:59.767Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-08-17T05:46:33.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74383",
      "date": "2026-09-16",
      "epss": "0.00142",
      "percentile": "0.03925"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74383\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:40.170\",\"lastModified\":\"2026-08-17T06:19:33.183\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools\\n\\nnvme_setup_descriptor_pools() indexes dev-\u003edescriptor_pools[] using the\\nnuma_node forwarded from hctx-\u003enuma_node by its single caller,\\nnvme_init_hctx_common().  On a non-NUMA kernel hctx-\u003enuma_node is\\nNUMA_NO_NODE (-1).  Because the parameter was declared \u0027unsigned\u0027, the\\nvalue becomes UINT_MAX and the index walks off the array (sized to\\nnr_node_ids), faulting during nvme_alloc_ns() and leaving the namespace\\nwithout a /dev node.\\n\\nReproduces on any NVMe controller probed by a CONFIG_NUMA=n kernel:\\n\\n  BUG: unable to handle page fault for address: ffff889101603d38\\n  RIP: 0010:nvme_init_hctx_common+0x5a/0x190 [nvme]\\n  Call Trace:\\n   nvme_init_hctx+0x10/0x20 [nvme]\\n   nvme_alloc_ns+0x9e/0xa10 [nvme_core]\\n   nvme_scan_ns+0x301/0x3b0 [nvme_core]\\n   nvme_scan_ns_async+0x23/0x30 [nvme_core]\\n\\nSwitch the parameter to int and fall back to node 0 when it is\\nNUMA_NO_NODE; node 0 is always present.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/host/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d977506f8863807129d7a11f4057dfb1b38085ea\",\"lessThan\":\"3e8aed5edaeeb237f97255d711aac6b5843fc059\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d977506f8863807129d7a11f4057dfb1b38085ea\",\"lessThan\":\"fa9b6accd1ad7af6914b409c6b003c417724c299\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d977506f8863807129d7a11f4057dfb1b38085ea\",\"lessThan\":\"a192b8cfa447e1b3701a13434a31c392b2e7ed29\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/host/pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3e8aed5edaeeb237f97255d711aac6b5843fc059\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a192b8cfa447e1b3701a13434a31c392b2e7ed29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa9b6accd1ad7af6914b409c6b003c417724c299\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T20:53:38+00:00",
      "cve": "CVE-2026-74383",
      "id": "CVE-2026-74383",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74383.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:06:31Z",
      "cve": "CVE-2026-74383",
      "id": "CVE-2026-74383",
      "initial_release_date": "2026-09-03T00:06:31Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74383",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74383.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.