CVE-2026-74384

A flaw was found in the Linux kernel's nvme-multipath component. This vulnerability arises from an incorrect calculation of a flexible array size, current_path[], which is indexed using Non-Uniform Memory Access (NUMA) node IDs. On certain architectures, such as powerpc, NUMA node IDs can be sparse, leading to out-of-bounds memory access when the array is indexed. This out-of-bounds write can cause a system crash, resulting in a Denial of Service (DoS).

An out-of-bounds write can occur in the NVMe multipath host code because nvme_ns_head current_path is allocated using num_possible_nodes() but later indexed with the actual NUMA node ID. On systems with sparse NUMA node IDs this can allocate too few entries and later write a struct nvme_ns pointer beyond the end of the object during namespace scan or path revalidation. For the CVSS the PR:N is used for paranoid scoring because a malicious or compromised NVMe controller or NVMe over Fabrics target on the storage fabric may trigger namespace discovery without needing privileges on the victim once the host is configured to use it. The attack complexity remains high because it depends on sparse NUMA topology, NVMe multipath, and controlled timing or discovery behavior. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to heap memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.