CVE-2026-74384

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-multipath: fix flex array size in struct nvme_ns_head

struct nvme_ns_head contains a flexible array member, current_path[],

which is indexed using the NUMA node ID:

head->current_path[numa_node_id()]

The structure is currently allocated as:

size = sizeof(struct nvme_ns_head) +

(num_possible_nodes() * sizeof(struct nvme_ns *));

head = kzalloc(size, GFP_KERNEL);

This allocation assumes that NUMA node IDs are sequential and densely

packed from 0 .. num_possible_nodes() - 1. While this assumption holds

on many systems, it is not always true on some architectures such as

powerpc.

On some powerpc systems, NUMA node IDs can be sparse. For example:

NUMA:

NUMA node(s): 6

NUMA node0 CPU(s): 80-159

NUMA node8 CPU(s): 0-79

NUMA node252 CPU(s):

NUMA node253 CPU(s):

NUMA node254 CPU(s):

NUMA node255 CPU(s):

That is, the possible/online NUMA node IDs are: 0, 8, 252, 253, 25

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References