CVE-2026-23244: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23244 is a memory allocation vulnerability in the Linux kernel's NVMe subsystem, specifically in the nvme_pr_read_keys() function. A local user with low privileges can pass a large num_keys value from userspace that causes an excessive memory allocation attempt (up to ~4MB), triggering a kernel page allocator warning when the allocation order exceeds MAX_PAGE_ORDER. Affected Linux kernel versions include 6.5 through 6.6.130 (fixed in 6.6.130), 6.7 through 6.12.77 (fixed in 6.12.77), 6.13 through 6.18.17 (fixed in 6.18.17), and 6.19 through 6.19.7 (fixed in 6.19.7), as well as 7.0-rc1 and 7.0-rc2. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read), with the underlying issue being insufficient validation of a userspace-supplied num_keys parameter in nvme_pr_read_keys() (drivers/nvme/host/pr.c). The function uses struct_size() to calculate the allocation size for the rse structure, with num_keys bounded only by PR_KEYS_MAX (64K entries), which can result in allocation requests up to approximately 4MB — exceeding the kernel's MAX_PAGE_ORDER limit for contiguous page allocation via kzalloc(). The fix replaces kzalloc() with kvzalloc(), which gracefully handles large allocations by falling back to vmalloc when contiguous physical memory is unavailable. The vulnerability was discovered via kernel fuzzing (syz-executor) and is analogous to a previously patched issue in the block layer (Red Hat Bugzilla, Kernel Announce).

Successful exploitation allows a local, low-privileged user to trigger kernel page allocator warnings and cause memory allocation failures in the NVMe subsystem, resulting in a denial of service condition. The availability impact is rated High, and there is also a High confidentiality impact noted in the CVSS scoring, though the primary practical consequence is system instability or kernel warning storms that could degrade or crash the affected system. There is no integrity impact, and the vulnerability does not enable remote code execution or lateral movement (Red Hat Advisory).

1. Gain local access: Obtain a low-privileged local user account on a system running a vulnerable Linux kernel version (6.5–6.6.129, 6.7–6.12.76, 6.13–6.18.16, or 6.19–6.19.6) with an NVMe storage device present.
2. Identify NVMe device: Locate an accessible NVMe block device (e.g., /dev/nvme0n1) that the user has permission to issue IOCTL calls against.
3. Craft malicious IOCTL: Issue a BLKPG_READ_KEYS IOCTL (ioctl code 0xc01070ce) to the NVMe device with a crafted structure containing a large num_keys value close to PR_KEYS_MAX (65535).
4. Trigger excessive allocation: The kernel's nvme_pr_read_keys() function computes a large allocation size via struct_size() and calls kzalloc(), which attempts a contiguous allocation exceeding MAX_PAGE_ORDER, triggering a kernel warning in mm/page_alloc.c.
5. Cause denial of service: Repeated invocations can generate continuous kernel warnings and memory allocation failures, potentially destabilizing the system (Red Hat Bugzilla).

• Logs: Kernel log entries containing WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof originating from the NVMe subsystem; call traces referencing nvme_pr_read_keys, blkdev_pr_read_keys, and blkdev_common_ioctl in /var/log/kern.log or dmesg output.
• Process: Unusual processes repeatedly issuing IOCTL calls (syscall number 16 / ioctl) to NVMe block devices with the request code 0xc01070ce; processes such as custom scripts or fuzzing tools (e.g., syz-executor) targeting /dev/nvme* devices.
• Network: No network-based indicators — this is a local exploitation vector only (Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.6.130 or later (for the 6.6 stable branch), 6.12.77 or later (for the 6.12 branch), 6.18.17 or later (for the 6.18 branch), or 6.19.7 or later (for the 6.19 branch). Patches are available in the upstream kernel stable repository. As a workaround, restrict unprivileged user access to NVMe block device IOCTLs using appropriate file permissions or access control policies (e.g., udev rules, SELinux/AppArmor policies). Monitor kernel logs for page allocation warnings from the NVMe subsystem as an early detection measure (Red Hat Advisory, Kernel Patches).

Red Hat has tracked this vulnerability via Bugzilla (Bug 2448601) and assigned it a low severity/priority rating, reflecting its limited exploitability and local-only attack vector. The vulnerability was announced via the official Linux kernel CVE announcement mailing list by Greg Kroah-Hartman. Amazon Linux and Debian have issued security advisories addressing this CVE in their respective kernel packages. No significant social media discussion or notable researcher commentary beyond standard vulnerability tracking has been observed (Red Hat Bugzilla, Kernel Announce).