CVE-2026-23244: Linux Kernel NVMe DOS Vulnerability

CVE-2026-23244 Overview

CVE-2026-23244 affects the Linux kernel NVMe (Non-Volatile Memory Express) host driver. The flaw resides in the nvme_pr_read_keys() function in drivers/nvme/host/pr.c, which handles Persistent Reservation key reads from userspace. The function accepts a num_keys value from userspace and passes it through struct_size() to compute an allocation size, with an upper limit of PR_KEYS_MAX (64K). A malicious or buggy userspace process can request an allocation of up to 4MB, which exceeds MAX_PAGE_ORDER in the page allocator and triggers a kernel warning. The issue was discovered via syzkaller fuzzing and resolved by replacing kzalloc() with kvzalloc().

Critical Impact
Local userspace can trigger a page allocator warning through ioctl calls on block devices, generating kernel log noise and potential allocation failure conditions in the NVMe persistent reservation subsystem.

Affected Products

Linux kernel NVMe host driver (drivers/nvme/host/pr.c)
Linux kernel version 6.19.0 (confirmed in warning log)
Block layer ioctl interface (blkdev_pr_read_keys)

Discovery Timeline

2026-03-18 - CVE-2026-23244 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23244

Vulnerability Analysis

The vulnerability is a kernel resource exhaustion issue in the NVMe Persistent Reservation read-keys ioctl path. When userspace calls ioctl(fd, NVME_IOCTL_*, ...) against a block device, the kernel routes the request through blkdev_pr_read_keys() in block/ioctl.c, which invokes nvme_pr_read_keys() at drivers/nvme/host/pr.c:245.

Inside nvme_pr_read_keys(), the kernel uses struct_size() to compute the buffer size required to hold num_keys entries of a reservation status element (rse). The function then calls kzalloc() to allocate the buffer. Because kzalloc() is backed by the slab allocator and ultimately by __alloc_frozen_pages_noprof(), allocation sizes that translate to a page order greater than MAX_PAGE_ORDER produce a WARN in mm/page_alloc.c:5216. With num_keys up to PR_KEYS_MAX, the requested allocation can reach approximately 4MB.

The fix replaces kzalloc() with kvzalloc(), which falls back to vmalloc-backed memory when contiguous physical pages are unavailable, avoiding the page allocator warning while still satisfying the allocation request.

Root Cause

The root cause is the use of kzalloc() for an allocation whose size is governed by an attacker-controlled value from userspace. While PR_KEYS_MAX caps the allocation at 64K entries, the resulting buffer can still exceed MAX_PAGE_ORDER worth of contiguous pages. The slab allocator does not transparently fall back to vmalloc for these requests, so the page allocator emits a warning and the allocation may fail.

Attack Vector

A local user with access to an NVMe block device node can invoke the persistent reservation read-keys ioctl with a large num_keys value. The syzkaller reproducer demonstrates the warning being reached through __x64_sys_ioctl from a standard userspace process. No authentication beyond block device access is required, and the attack does not need network access.

The vulnerability is described in prose because no exploit code is published. See the Linux Kernel Commit baef52d8 and related stable commits for the technical fix.

Detection Methods for CVE-2026-23244

Indicators of Compromise

Kernel log entries containing WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof originating from the nvme_pr_read_keys call path.
Stack traces in dmesg showing blkdev_pr_read_keys → nvme_pr_read_keys → __kmalloc_noprof followed by an allocator warning.
Repeated ioctl calls against /dev/nvme* block devices with anomalous reservation key counts.

Detection Strategies

Parse /var/log/kern.log and journalctl -k output for __alloc_frozen_pages_noprof warnings correlated with NVMe device file descriptors.
Use auditd rules on the ioctl syscall against /dev/nvme* nodes to capture caller PID, UID, and argument structure.
Monitor eBPF tracepoints on kmalloc and kvmalloc events for large size requests originating from the block ioctl path.

Monitoring Recommendations

Forward kernel warnings and ioctl audit events to a centralized log platform for correlation across hosts.
Track per-user ioctl rates on NVMe devices and alert on outliers, particularly from unprivileged accounts.
Baseline normal nvme_pr_read_keys usage on storage hosts so anomalous calls from non-storage workloads are surfaced quickly.

How to Mitigate CVE-2026-23244

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry once a fixed kernel build is available for your distribution.
Restrict access to /dev/nvme* block device nodes to trusted system accounts using standard udev rules and group ownership.
Audit containerized workloads that map block devices into containers and remove unnecessary device passthrough.

Patch Information

The fix replaces kzalloc() with kvzalloc() in nvme_pr_read_keys(). Backports are published in the following stable kernel commits: Linux Kernel Commit 15fb6d6, Linux Kernel Commit 5a50137, Linux Kernel Commit baef52d8, Linux Kernel Commit c332015, and Linux Kernel Commit e42ff5ab.

Workarounds

Remove read or ioctl permissions on NVMe block device nodes for non-administrative users until a patched kernel is deployed.
Disable persistent reservation features on systems where they are unused by restricting block layer ioctl exposure inside container runtimes.
Apply seccomp profiles that block the ioctl syscall on workloads that do not require it.

bash

# Restrict NVMe device node access to the disk group only
for dev in /dev/nvme*; do
  chown root:disk "$dev"
  chmod 0660 "$dev"
done

# Verify kernel version after patching
uname -r