CVE-2026-89483

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme: zero the discard fallback page

nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) *

NVME_DSM_MAX_RANGES = 4096 bytes as the DSM payload however many ranges

the command declares, because some devices ignore the 'Number of Ranges'

field - the Fixes: commit records two that read past the declared ranges.

A single-range discard fills only the first 16 bytes.

Normally the buffer comes from kzalloc() and the other 4080 bytes are

zero. When that allocation fails the code falls back to the

per-controller ctrl->discard_page, which nvme_init_ctrl() obtains with

alloc_page(GFP_KERNEL) and nothing ever zeroes, so those 4080 bytes are

whatever the page last held and are handed to the controller. Reaching

it requires the kzalloc(GFP_ATOMIC | __GFP_NOWARN) to fail, that is

memory pressure; it is not remotely triggerable. Failing the allocation

under KMSAN reproduces it, with the leaked tail full of vmemmap str

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References