EUVD-2026-59530
GHSA-2x9w-pwqr-6m8q
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trigger is automatic kernel hardware probing (PR:N, UI:N, AV:L); confirmed impact is kernel crash and device loss, not demonstrated memory disclosure or write primitive (C:N, I:N, A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] using the numa_node forwarded from hctx->numa_node by its single caller, nvme_init_hctx_common(). On a non-NUMA kernel hctx->numa_node is NUMA_NO_NODE (-1). Because the parameter was declared 'unsigned', the value becomes UINT_MAX and the index walks off the array (sized to nr_node_ids), faulting during nvme_alloc_ns() and leaving the namespace without a /dev node.
Reproduces on any NVMe controller probed by a CONFIG_NUMA=n kernel:
BUG: unable to handle page fault for address: ffff889101603d38 RIP: 0010:nvme_init_hctx_common+0x5a/0x190 [nvme] Call Trace: nvme_init_hctx+0x10/0x20 [nvme] nvme_alloc_ns+0x9e/0xa10 [nvme_core] nvme_scan_ns+0x301/0x3b0 [nvme_core] nvme_scan_ns_async+0x23/0x30 [nvme_core]
Switch the parameter to int and fall back to node 0 when it is NUMA_NO_NODE; node 0 is always present.
AnalysisAI
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must simultaneously be met: (1) The running Linux kernel must have been compiled with CONFIG_NUMA=n - this is the sole gate, and its absence in all major distribution kernels drastically limits real-world exposure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.4 with AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores the worst-case kernel out-of-bounds access scenario, but the C:H and I:H components appear inflated relative to the described outcome: the CVE explicitly documents a kernel page fault and loss of the NVMe /dev node, not a confirmed read or write primitive for privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a system running a CONFIG_NUMA=n Linux kernel - such as a lightweight edge device, embedded appliance, or minimal VM - an NVMe controller is probed at boot or on hotplug insertion. The kernel's nvme_init_hctx_common() passes NUMA_NO_NODE (-1) to nvme_setup_descriptor_pools() where integer wrap converts it to UINT_MAX, and the subsequent array dereference on dev->descriptor_pools[] triggers a kernel page fault at an unmapped address (e.g., ffff889101603d38), crashing the nvme driver subsystem and leaving all NVMe namespaces without /dev nodes, causing data inaccessibility. … |
| Remediation | The primary fix is to upgrade the Linux kernel to version 7.1.5, 7.2-rc1, or 6.18.40 (stable), each of which incorporates the corrected nvme_setup_descriptor_pools() parameter type. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Query infrastructure inventory to identify systems running Linux kernels with CONFIG_NUMA=n and active NVMe storage. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today