A critical out-of-bounds memory access vulnerability in the Linux kernel nvme-multipath subsystem could allow for system instability or arbitrary code execution.

The vulnerability exists in the nvme-multipath component, where the allocation of the current_path array assumes sequential NUMA node IDs. On architectures with sparse NUMA node IDs, such as powerpc, this leads to an out-of-bounds memory access when the kernel indexes the array using actual node IDs.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. An attacker capable of triggering this memory corruption could potentially achieve arbitrary code execution, leading to total loss of system confidentiality, integrity, and availability. Such an event would result in significant operational disruption and data exposure risks for the enterprise.

Immediate Action: Update your Linux kernel to the versions provided by your distribution maintainer, specifically ensuring kernels are at least 5.10.261, 5.15.212, 6.1.178, or 6.6.145.

Proactive Monitoring: Monitor system logs for kernel panic events or segmentation faults that may indicate memory corruption attempts.

Compensating Controls: Ensure that systems are running with hardened kernel configurations and that untrusted users are restricted from interacting with NVMe-multipath configurations.

Public Exploit Available: No

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching their Linux distributions as soon as upstream security updates are backported. Failure to mitigate this issue leaves critical infrastructure exposed to potential memory corruption attacks that could bypass standard user-space security controls.