What is the CVSS score of CVE-2026-23244?

CVE-2026-23244 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-23244?

Yes, a patch is available for CVE-2026-23244. Update the affected software to the latest version immediately.

Linux CVE-2026-23244

EUVD-2026-12805 HIGH

Out-of-bounds Read (CWE-125)

2026-03-18 Linux

Buffer Overflow Information Disclosure Linux

High

Disputed · 7.1 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability presents a moderate real-world risk despite the absence of a published CVSS score or EPSS value. The attack vector is local (requires userspace process access) with low complexity (simple ioctl call with crafted num_keys parameter), requiring unprivileged user privileges to trigger. The technical impact is limited to denial of service through page allocator warnings and potential memory pressure rather than code execution or privilege escalation. The vulnerability is NOT listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no active exploitation in the wild. However, the fix's simplicity (switching from kzalloc to kvzalloc) and the clear demonstration via syz-executor (Linux kernel fuzzer) indicate this is a legitimate kernel issue discovered through formal fuzzing rather than exploitation. The primary concern is denial of service on systems running affected kernel versions where untrusted users can execute ioctl commands. Linux distributions will have resolved this through kernel updates on affected stable branches (6.12.77, 6.18.17, 6.19.7, 7.0-rc3), making this primarily a priority for systems on 6.5 or earlier releases.
Exploit ScenarioDerived	A local attacker with unprivileged user access executes an ioctl call (BLKPRGET with code 0xc01070ce) against an NVMe block device, passing a specially crafted num_keys value close to PR_KEYS_MAX (65536) through the blkdev_common_ioctl handler. This triggers nvme_pr_read_keys() to attempt a kzalloc() of approximately 4MB (struct_size overhead plus keys array), which exceeds the kernel's maximum contiguous page allocation limit and generates a kernel warning in __alloc_frozen_pages_noprof(). Repeated invocation of this syscall causes sustained memory pressure and page allocator warnings, potentially degrading system performance or triggering out-of-memory conditions that affect other processes. The attack requires only standard user privileges and a single ioctl call, making it trivially exploitable on vulnerable kernels with exposed NVMe devices.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

A memory allocation vulnerability exists in the Linux kernel's NVMe Persistent Reservation implementation where the nvme_pr_read_keys() function fails to properly handle large num_keys values passed from userspace, resulting in excessive memory allocation attempts up to 4MB that trigger page allocator warnings and potential denial of service. This affects Linux kernel versions across multiple stable branches (6.5, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3) and requires local access with ioctl privileges to trigger. The vulnerability is addressed through replacement of kzalloc() with kvzalloc() to support larger allocations via vmalloc fallback, and patches are available across multiple kernel stable branches.

RemediationAI

The primary remediation is to upgrade the Linux kernel to a patched version: for kernel 6.5 users, upgrade to 6.5.13 or later; for 6.12 users, upgrade to 6.12.77 or later; for 6.18 users, upgrade to 6.18.17 or later; for 6.19 users, upgrade to 6.19.7 or later; for 7.0-rc users, upgrade to 7.0-rc3 or later. The specific upstream fixes are available at the git.kernel.org stable commit references provided (15fb6d627484ee39ed73e202ef4720e1fa5c898e, 5a501379a010690ae9ae88bef62a1bae1aca32e6, baef52d80093bd686e70b3cb7e0512a40ae76705, c3320153769f05fd7fe9d840cb555dd3080ae424). Most Linux distributions have already backported this fix to their kernel packages; verify your distribution's security advisory and apply the available kernel update through your package manager (apt, yum, zypper, etc.). Until kernel patching is possible, system administrators can mitigate local DoS risk by restricting ioctl access to trusted applications through AppArmor or SELinux policies targeting the blkdev ioctl interface (BLKPRGET, BLKPRSET commands), though this may impact legitimate NVMe PR functionality.

Affected VersionsENISA

Linux 5fd96a4e15de8442915a912233d800c56f49001d <baef52d80093bd686e70b3cb7e0512a40ae76705

Linux 5fd96a4e15de8442915a912233d800c56f49001d <15fb6d627484ee39ed73e202ef4720e1fa5c898e

Linux 5fd96a4e15de8442915a912233d800c56f49001d <c3320153769f05fd7fe9d840cb555dd3080ae424

Linux patch: 6.12.77

Linux patch: 6.19.7

Linux patch: 0

Linux 5fd96a4e15de8442915a912233d800c56f49001d <5a501379a010690ae9ae88bef62a1bae1aca32e6

Linux 6.5

Linux patch: 7.0-rc3

Linux patch: 6.18.17

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Linux kernel's NVMe driver subsystem, specifically in the block layer's Persistent Reservation (PR) implementation accessed via the blkdev_ioctl interface. The affected code path is drivers/nvme/host/pr.c in the nvme_pr_read_keys() function, which accepts user-controlled num_keys parameter and calculates allocation size using struct_size() with an upper limit of PR_KEYS_MAX (65536). The root cause is CWE-400 (Uncontrolled Resource Consumption) combined with improper memory allocation strategy: kzalloc() uses only the slab allocator and fails with warnings when requested orders exceed MAX_PAGE_ORDER (typically order 10 on x86, limiting contiguous allocations to ~4MB), whereas kvzalloc() automatically falls back to vmalloc() for larger requests. The CPE identifier cpe:2.3:a:linux:linux indicates this affects the Linux kernel product itself across all architectures and configurations.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

NVD PRIMARY 7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SUSE HIGH

Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

May 21, 2026 - 16:07 NVD

7.1 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 18, 2026 - 10:05 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix memory allocation in nvme_pr_read_keys()

nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K).

A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds MAX_PAGE_ORDER.

To fix this, use kvzalloc() instead of kzalloc().

This bug has the same reasoning and fix with the patch below: https://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/

Warning log: WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272 Modules linked in: CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216 Code: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 <0f> 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d RSP: 0018:ffffc90000fcf450 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0 RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0 RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001 R10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000 R13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620 FS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0 Call Trace: <TASK> alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486 alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557 ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598 __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629 __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245 blkdev_pr_read_keys block/ioctl.c:456 [inline] blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730 blkdev_ioctl+0x299/0x700 block/ioctl.c:786 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583 x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb893d3108d Code: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d RDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001 </TASK>

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Bounds Check Flaws

View all 7

CVE-2026-23247 MEDIUM

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky	vulnerable	6.19.6-2	-
sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23244 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/?id.351519 REF https://git.kernel.org/stable/c/15fb6d627484ee39ed73e202ef4720e1fa5c898e REF https://git.kernel.org/stable/c/5a501379a010690ae9ae88bef62a1bae1aca32e6 REF https://git.kernel.org/stable/c/baef52d80093bd686e70b3cb7e0512a40ae76705 REF https://git.kernel.org/stable/c/c3320153769f05fd7fe9d840cb555dd3080ae424 REF https://git.kernel.org/stable/c/e42ff5abbd14927553b624c0e06d24df76156fe6

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back