CVE-2026-74384 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should verify exposure and apply patches to prevent potential out-of-bounds memory access. This includes verifying Linux kernel version and NUMA configuration, applying patches to update the nvme-multipath subsystem, and monitoring for potential out-of-bounds memory access. Security teams and vulnerability management teams should also review the vulnerability and assess the impact on their systems.

Why it matters

Linux kernel maintainers and users should verify exposure and apply patches to prevent potential out-of-bounds memory access.

• Verify Linux kernel version and NUMA configuration to assess exposure
• Apply patches to update the nvme-multipath subsystem
• Monitor for potential out-of-bounds memory access

Technical summary

The Linux kernel's nvme-multipath subsystem has a vulnerability where memory is allocated for a flexible array based on the number of possible NUMA nodes, but indexed using the actual NUMA node ID, leading to potential out-of-bounds access on systems with sparse node IDs. The bug was introduced in the allocation of memory for the flexible array current_path[] in struct nvme_ns_head. The allocation size is calculated using num_possible_nodes(), but the array is indexed using numa_node_id(). This can lead to out-of-bounds memory access, potentially causing system crashes or privilege escalation.

Defensive priority

Linux kernel maintainers and users should verify exposure and apply patches to prevent potential out-of-bounds memory access.

Recommended defensive actions

• Verify Linux kernel version and NUMA configuration to assess exposure
• Apply patches to update the nvme-multipath subsystem
• Monitor for potential out-of-bounds memory access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The Linux kernel source code shows a vulnerability in the nvme-multipath subsystem, where memory is allocated for a flexible array based on the number of possible NUMA nodes, but indexed using the actual NUMA node ID, leading to potential out-of-bounds access on systems with sparse node IDs. The bug was introduced in the allocation of memory for the flexible array current_path[] in struct nvme_ns_head. The allocation size is calculated using num_possible_nodes(), but the array is indexed using numa_node_id(). This can lead to out-of-b

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.