Linux kernel (drivers/nvme/host): The PRP list mempool is sized in the wrong units, so a large I/O that needs two PRP

CVSS 7.8CVE-2022-50756Kernel, userspace & hypervisorcurated

Impact

The PRP list mempool is sized in the wrong units, so a large I/O that needs two PRP lists writes past the end of the pool allocation. This is a genuine heap overflow on the local NVMe data path - kfence caught it in practice - so one tenant's I/O can corrupt kernel memory belonging to the rest of the node.

Who can reach it

Reachable by any unprivileged process on the node that can issue I/O to a local PCIe NVMe device (a container with a scratch volume is enough) - no /dev/nvme passthrough required. The window is narrow: it needs roughly a 4MB transfer split into 127 physical segments on a submission queue whose controller does not support SGLs. Most enterprise NVMe negotiates SGLs and is therefore not on this path, so check controller capability before rating this urgent on a given SKU.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: confirm whether the node's NVMe controllers advertise SGL support (SGL-capable queues do not take this path), and cap the maximum I/O size handed to tenants on any controller that does not.

References

https://git.kernel.org/stable/c/dfb6d54893d544151e7f480bc44cfe7823f5ad23 https://git.kernel.org/stable/c/9141144b37f30e3e7fa024bcfa0a13011e546ba9 https://nvd.nist.gov/vuln/detail/CVE-2022-50756

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.