Linux Kernel CVE-2026-74383

Two conditions must simultaneously be met: (1) The running Linux kernel must have been compiled with CONFIG_NUMA=n - this is the sole gate, and its absence in all major distribution kernels drastically limits real-world exposure. (2) An NVMe storage controller must be present and probed by the kernel, whether at boot time or via hotplug. No attacker authentication, network access, or user interaction is required once these structural conditions exist - the fault triggers automatically within the kernel during device initialization. Limiting factors: CONFIG_NUMA=y (present in virtually all enterprise/cloud/distribution kernels) completely prevents the vulnerability; systems without NVMe hardware are unaffected; the CVSS PR:N rating reflects that the trigger is the kernel's own hardware enumeration code, not a user-space action.

The NVD-assigned CVSS 3.1 score of 8.4 with AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores the worst-case kernel out-of-bounds access scenario, but the C:H and I:H components appear inflated relative to the described outcome: the CVE explicitly documents a kernel page fault and loss of the NVMe /dev node, not a confirmed read or write primitive for privilege escalation. EPSS at 0.17% (6th percentile) strongly contradicts the high CVSS severity in practical terms. The vulnerability is not listed in CISA KEV and no public exploit or POC has been identified. The critical limiting factor is that exploitation requires a kernel compiled with CONFIG_NUMA=n - a configuration absent from virtually all enterprise Linux distributions (RHEL, SUSE, Ubuntu Server, Debian server kernels), cloud hypervisor images, and most x86_64 desktop distributions, all of which enable NUMA. Practically affected targets are embedded Linux, stripped-down VMs, developer builds, and some IoT/edge configurations. For environments running standard distribution kernels, this is a low operational priority despite the high CVSS.

On a system running a CONFIG_NUMA=n Linux kernel - such as a lightweight edge device, embedded appliance, or minimal VM - an NVMe controller is probed at boot or on hotplug insertion. The kernel's nvme_init_hctx_common() passes NUMA_NO_NODE (-1) to nvme_setup_descriptor_pools() where integer wrap converts it to UINT_MAX, and the subsequent array dereference on dev->descriptor_pools[] triggers a kernel page fault at an unmapped address (e.g., ffff889101603d38), crashing the nvme driver subsystem and leaving all NVMe namespaces without /dev nodes, causing data inaccessibility. No public exploit code exists; the scenario is reproduced by any NVMe controller probe on an affected kernel configuration.