Linux nvme-pci: slab out-of-bounds read in nvme_dbbuf_set during controller reset

Impact

nvme_dbbuf_set() looped past dev->online_queues, reading one entry beyond the doorbell-buffer array allocated at probe time; KASAN catches it as a slab out-of-bounds read reached from nvme_reset_work. The path runs on NVMe controller reset, which happens on probe, on error recovery and on device hotplug - all of which occur on their own on GPU nodes with local NVMe scratch, so no attacker action is needed to hit it. The practical risk is a host crash or corrupted doorbell state on the node's local storage path, which on a GPU host means an unplanned loss of every job resident on it. The record documents a read, not a write, and names no privilege-escalation path.

Who can reach it

No network or tenant path. The faulty loop runs in the kernel's nvme-reset workqueue, so it is reached by the host itself during NVMe probe, reset or error recovery; local access only, and triggering it deliberately needs control over the NVMe device's reset behaviour.

What to do

Update to a stable kernel with the corrected loop bound; commits are linked across 5.10 through 7.0 branches. This requires a kernel update and a reboot of each node with NVMe devices - in practice all of them - so schedule it as a rolling drain and reboot. No mitigation or configuration workaround is described.

References

Related entries

• Linux EFI: unaccepted-memory table under-reserved, panicking large Intel TDX guestsCVE-2026-45851 · Linux kernel EFI unaccepted-memory table reservation (reserve_unaccepted)High
• Linux kernel crypto authencesn: out-of-bounds access with a 1-3 byte ahash digest via AF_ALGCVE-2026-46033 · Linux kernel crypto authencesn (ahash digest size validation)High
• Linux kernel (drivers/iommu/intel): Killing a VM that has a device attached through the VT-d nested/PASID path makesCVE-2026-52953 · Linux kernel (drivers/iommu/intel)High
• Linux kernel BPF: out-of-bounds read copying unaligned cgroup-storage values into a per-CPU mapCVE-2026-53076 · Linux kernel BPF (pcpu_init_value, per-CPU map element copy)High
• Linux kernel (virt/kvm): A guest store that splits a page and lands on a datamatch-enabled ioeventfd reaches a BUG_ONCVE-2026-63806 · Linux kernel (virt/kvm)High
• Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18h: AVIC inter-processor-interrupt virtualization is unsafe onCVE-2026-64172 · Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18hHigh