Linux kernel NVMe: userspace num_keys drives a multi-megabyte kzalloc in nvme_pr_read_keys()

Impact

The persistent-reservation read-keys ioctl takes num_keys from userspace, up to PR_KEYS_MAX, and passes the resulting size to kzalloc, so a caller can request roughly a 4 MB physically contiguous allocation and trip the page allocator's MAX_PAGE_ORDER warning. Impact is a kernel warning and a failed high-order allocation, not memory corruption; the fix is simply kvzalloc. It matters on GPU nodes only where a tenant workload holds an NVMe block device directly - local scratch passed into a pod, or a shared-storage host where PR ioctls are reachable - and even there the practical result is log noise and allocator pressure rather than a tenant boundary break. The CVSS metrics NVD carries for this record are considerably more severe than the described behaviour.

Who can reach it

Local user with an open file descriptor on an NVMe block device and permission to issue the persistent-reservation read-keys ioctl - typically root or a container granted the device. Not reachable remotely or from an unprivileged pod without device access.

What to do

Pick up the stable kernel patch (kzalloc -> kvzalloc in drivers/nvme/host/pr.c) in your distro kernel; applying it means a node reboot into the new kernel, so it fits a routine maintenance cycle rather than an emergency drain. Restricting direct NVMe device access for tenant pods removes the exposure without a reboot.

References

Related entries

• Linux kernel CXL mailbox: undersized raw command payload read out of boundsCVE-2026-23327 · Linux kernel CXL core mailbox (cxl_payload_from_user_allowed)High
• Linux kernel (drivers/pci/controller/dwc): Raising an MSI-X interrupt is a posted PCI write, and the endpoint driverCVE-2026-23361 · Linux kernel (drivers/pci/controller/dwc)High
• Linux nvme-pci: slab out-of-bounds read in nvme_dbbuf_set during controller resetCVE-2026-43449 · Linux kernel nvme-pci driver (nvme_dbbuf_set doorbell buffer loop)High
• Linux EFI: unaccepted-memory table under-reserved, panicking large Intel TDX guestsCVE-2026-45851 · Linux kernel EFI unaccepted-memory table reservation (reserve_unaccepted)High
• Linux kernel crypto authencesn: out-of-bounds access with a 1-3 byte ahash digest via AF_ALGCVE-2026-46033 · Linux kernel crypto authencesn (ahash digest size validation)High
• Linux kernel (drivers/iommu/intel): Killing a VM that has a device attached through the VT-d nested/PASID path makesCVE-2026-52953 · Linux kernel (drivers/iommu/intel)High