CVE-2026-89483

A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) subsystem. Under specific memory pressure conditions, a local user could trigger a scenario where uninitialized kernel memory is used and potentially exposed. This could lead to information disclosure, revealing sensitive data from the system's memory.

A MODERATE severity information exposure flaw was found in the Linux kernel's NVMe subsystem. When building a discard command, nvme_setup_discard() always maps a full 4096-byte dataset management (DSM) payload regardless of how many ranges the command declares, because some devices ignore the 'Number of Ranges' field. Normally the buffer comes from kzalloc() and the unused bytes are zero, but when that allocation fails under kernel memory pressure the code falls back to the per-controller ctrl->discard_page, which is allocated without zeroing. Up to roughly 4080 bytes of whatever that page previously held can then be handed to the NVMe controller, exposing residual kernel memory contents (the reproducer observed vmemmap struct page pointers). Exploitation requires a local actor able to issue discard operations while inducing kernel memory allocation failure; the issue is not remotely triggerable. Red Hat Product Security rated this flaw MODERATE with CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVEORG score of 7.5, because triggering the vulnerable path requires local access and specific memory-pressure conditions rather than remote unauthenticated access. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present. For the affected Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and OpenShift (RHCOS) kernel streams, the fix is deferred because this MODERATE-severity flaw has a CVSS score below the threshold at which Red Hat files fix trackers for those streams; the residual risk is a local exposure of prior page contents to the NVMe controller, limited to situations of severe memory pressure during discard operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.