Linux kernel (drivers/nvme/host): The multipath current-path array is sized by the count of possible NUMA nodes but

Impact

The multipath current-path array is sized by the count of possible NUMA nodes but indexed by the actual NUMA node ID. On any machine whose node IDs are sparse rather than 0..N-1, ordinary I/O writes eight bytes past the end of the slab allocation - silent heap corruption of whatever object sits next, driven by the normal data path rather than by an error case.

Who can reach it

No attacker action is required beyond running I/O: any tenant's reads and writes through an NVMe multipath device index the array by the NUMA node of the CPU they land on. Reachability is a hardware/topology condition, not a permission one - it needs a system with non-contiguous NUMA node IDs (the report is from POWER9 with nodes 0, 8, 252-255; check ls /sys/devices/system/node/ on non-x86 or accelerator-heavy nodes before assuming you are clear). Dense-node x86 hosts are not affected.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: audit node IDs on every architecture in the fleet and prioritise patching hosts with sparse NUMA topology; there is no configuration knob that avoids the bad index.

References