In the Linux kernel, a bug in the NVMe multipath driver caused the flexible array member of a namespace header to be allocated based on the number of possible NUMA nodes rather than the maximum node ID. The driver then indexed this array with the actual NUMA node ID, which on systems with non‑sequential node IDs could go beyond the allocated bounds, resulting in a KASAN memory corruption. The vulnerability is a classic heap buffer overflow that can corrupt kernel memory. The impact is the potential loss of confidentiality, integrity, or availability at kernel level, including the possibility of arbitrary code execution with elevated privileges.

The flaw affects any deployment of the Linux kernel that includes the NVMe multipath driver on hardware with sparse NUMA node IDs, such as certain PowerPC and POWER9 platforms. The description provides an example configuration where node IDs 0, 8, 252, 253, 254, and 255 exist but the allocation assumes 0–5. All kernel builds exposing this code path are affected; the exact kernel release(s) are not listed, but the commit references indicate a recent fix in a development branch.

Exploitability depends on the ability to trigger NVMe namespace enumeration or revalidation in the affected kernel. While no public exploit is documented, the EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The nature of the vulnerability—heap-based buffer overflow in the kernel—implies a high likelihood of exploitation by a malicious actor with access to untrusted NVMe commands or by an attacker who can influence NVMe device usage. The vulnerability is not included in the CISA KEV catalog, but the potential for privilege escalation warrants a high risk assessment until a patched kernel is deployed. The CVSS score of 9.8 indicates a critical level of severity.