In the Linux kernel, the function nvme_pr_read_keys() receives a key count from userspace and uses that value to compute how many bytes to allocate for a request structure. The computation is limited by PR_KEYS_MAX (64 KiB) but, if the caller supplies a very large num_keys, the size calculation can exceed the page allocator’s maximum order, causing an allocation of up to 4 MiB and triggering a warning. The bug is a classic uncontrolled memory‑allocation issue that can make an NVMe operation fail and ultimately lead to denial of service. The patch changes the allocation routine from kzalloc() to kvzalloc() to prevent the improper behaviour.

All Linux kernel builds that include the buggy nvme_pr_read_keys() implementation are implicated. Any system running a pre‑patch kernel with the NVMe subsystem enabled is technically vulnerable. Specific affected revision information is not supplied, so any kernel version prior to the inclusion of the CVE‑2026‑23244 fix is at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % points to a low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector would be local users or processes with elevated privileges that can issue the NVMe ioctl that calls nvme_pr_read_keys(). The flaw can cause a denial of service but does not provide privilege escalation or direct data disclosure. Successful exploitation would therefore require the attacker to be able to trigger the oversized key request from a local context; the resulting kernel warning would be visible system logs and the affected NVMe operation would fail.