CVE-2026-74383

A flaw was found in the NVMe-PCI subsystem of the Linux kernel. An out-of-bounds access can occur in the nvme_setup_descriptor_pools() function when handling Non-Uniform Memory Access (NUMA) node values on systems configured without NUMA support. This incorrect indexing can lead to a page fault, preventing the NVMe namespace from being properly initialized and resulting in a denial of service for the affected NVMe controller.

An out of bounds access in nvme_setup_descriptor_pools occurs because NUMA_NO_NODE (-1) from hctx numa_node is passed through an unsigned parameter and becomes UINT_MAX. On CONFIG_NUMA n kernels this indexes dev descriptor_pools far beyond the nr_node_ids sized array during NVMe namespace allocation, which can fault the kernel and leave the namespace without a device node. For the CVSS the PR:H is used for the base score because reliable triggering usually requires administrative control over NVMe probe, driver bind, reset, or hotplug paths. For the CVSS the PR:L is used for the paranoid score only if a less privileged local actor can indirectly force NVMe reprobe in a delegated environment. The issue is not network reachable and is tied to local hardware or local driver control. Impact is at least denial of service via kernel crash. Because the primitive is an out of bounds kernel access, limited confidentiality or integrity impact is kept in the paranoid score and the case should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.