CVE-2026-23244
Improper Memory Allocation in Linux NVMe Driver Causes Kernel Warning
Publication date: 2026-03-18
Last updated on: 2026-03-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific warning messages related to memory allocation failures in the nvme_pr_read_keys() function.
Look for warnings similar to: "WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof" which indicate a large memory allocation attempt triggered by a malicious or buggy userspace.
You can use the following command to check the kernel log for such warnings:
- dmesg | grep -i 'WARNING: mm/page_alloc.c:5216'
Additionally, monitoring for unusual nvme_pr_read_keys() calls or abnormal memory allocation sizes related to NVMe devices may help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Linux kernel to a version where this vulnerability is fixed.
The fix involves changing the memory allocation method in nvme_pr_read_keys() from kzalloc() to kvzalloc(), preventing large memory allocation attempts that cause warnings and potential instability.
Until the kernel is updated, monitoring system logs for warning signs and restricting untrusted userspace access to NVMe ioctl interfaces can help reduce risk.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's NVMe driver, specifically in the function nvme_pr_read_keys(). The function takes a number of keys (num_keys) from userspace and uses it to calculate the size of a memory allocation. However, a malicious or buggy userspace program can supply a very large num_keys value, which leads to an attempt to allocate up to 4MB of memory at once.
This large allocation can cause a warning in the kernel's page allocator because the allocation order exceeds the maximum allowed (MAX_PAGE_ORDER). The issue was fixed by changing the memory allocation method from kzalloc() to kvzalloc(), which better handles large allocations.
How can this vulnerability impact me? :
The vulnerability can cause the Linux kernel to attempt a large memory allocation based on user input, which may trigger warnings or instability in the kernel's memory management system. This could potentially lead to denial of service conditions if the system becomes unstable or crashes due to improper memory allocation handling.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know