A memory initialization flaw in the Linux kernel NVMe driver may allow for the unintended exposure of sensitive kernel memory data to storage devices.

The vulnerability exists in the nvme_setup_discard function, which fails to zero the fallback discard page when memory allocation fails. This results in the leakage of residual data from previously used kernel pages to the NVMe controller, which can occur without any required authentication.

The leakage of sensitive kernel memory could result in the unauthorized exposure of critical information, including internal system pointers or data processed by the kernel. While the CVSS score of 7.5 reflects a high potential for information disclosure, the practical exploitability is limited by the requirement for specific memory pressure conditions to trigger the fallback mechanism. Organizations should prioritize patching to prevent potential data exfiltration or reconnaissance by sophisticated local actors.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel memory allocation failures or unexpected NVMe controller errors that might indicate an attempt to trigger the memory pressure condition.

Compensating Controls: Ensure that kernel hardening features such as KASLR are enabled to increase the difficulty of exploiting memory-related vulnerabilities.

Public Exploit Available: No.

Although the conditions required to trigger this vulnerability are restrictive, it represents a significant risk to kernel-level data confidentiality. Administrators should plan for a kernel update during the next scheduled maintenance window to ensure the resolution is applied across all affected production systems.