# CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set

Status: published. Published: 2026-05-08. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set

dev->online_queues is a count incremented in nvme_init_queue. Thus,
valid indices are 0 through dev->online_queues − 1.

This patch fixes the loop condition to ensure the index stays within the
valid range. Index 0 is excluded because it is the admin queue.

KASAN splat:

==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74

CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: nvme-reset-wq nvme_reset_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xce/0x5d0 mm/kasan/report.c:482
 kasan_report+0xdc/0x110 mm/kasan/report.c:595
 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379
 nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
 nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
 nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252
 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
 kthread+0x41a/0x930 kernel/kthread.c:463
 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Allocated by task 34 on cpu 1 at 4.241550s:
 kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57
 kasan_save_track+0x1c/0x70 mm/kasan/common.c:78
 kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5657 [inline]
 __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663
 kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]
 nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]
 nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534
 local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324
 pci_call_probe drivers/pci/pci-driver.c:392 [inline]
 __pci_device_probe drivers/pci/pci-driver.c:417 [inline]
 pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451
 call_driver_probe drivers/base/dd.c:583 [inline]
 really_probe+0x29b/0xb70 drivers/base/dd.c:661
 __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803
 driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833
 __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159
 async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129
 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
 kthread+0x41a/0x930 kernel/kthread.c:463
 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

The buggy address belongs to the object at ffff88800592a000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 244 bytes to the right of
 allocated 1152-byte region [ffff88800592a000, ffff88800592a480)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)
page_type: f5(slab)
raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000040 ffff888001042000 00000
---truncated---

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e

## Affected products and versions

- Linux / Linux: ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < 2b9d605c3f0d3262142f196249cd3bd58c857c71 (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < 86183d550559e45e07059bbdf17331fea469e38c (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < d7990c936e25f484b61a5adeeadc1d290a9fd16e (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < 83e6edd6358326c9c2de31a54bb4a1ec50703f1f (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < 50bad78f03a02d3c0f228edf9912b494d3e7acb9 (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < 328c551f0cc81ee776b186b86cc6e5253bb6fda7 (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < 78279d2d74c58a0ed64e43cf601a02649771182e (affected, git); ≥ 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf; < b4e78f1427c7d6859229ae9616df54e1fc05a516 (affected, git); 930bb3092fe606baa23d57ae59b70b291d67a8af (affected, git); fd1c1de8c4589fdd528733bfd01ed0c5f3f69204 (affected, git); 4940816604e3ce7e05e8df297773ee86c0476d48 (affected, git); 55a3b1ad694631cc2698b5500ac5865d7d0f064e (affected, git); ≥ 4.14.210; < 4.15 (affected, semver); ≥ 4.19.161; < 4.20 (affected, semver); ≥ 5.4.81; < 5.5 (affected, semver); ≥ 5.9.12; < 5.10 (affected, semver). Source: CNA: Linux
- Linux / Linux: 5.10 (affected); ≥ 0; < 5.10 (unaffected, semver); ≥ 5.10.253; ≤ 5.10.* (unaffected, semver); ≥ 5.15.203; ≤ 5.15.* (unaffected, semver); ≥ 6.1.167; ≤ 6.1.* (unaffected, semver); ≥ 6.6.130; ≤ 6.6.* (unaffected, semver); ≥ 6.12.78; ≤ 6.12.* (unaffected, semver); ≥ 6.18.19; ≤ 6.18.* (unaffected, semver); ≥ 6.19.9; ≤ 6.19.* (unaffected, semver); ≥ 7.0; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "4.15",
            "versionStartIncluding": "4.14.210",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "4.20",
            "versionStartIncluding": "4.19.161",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "5.5",
            "versionStartIncluding": "5.4.81",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "5.10",
            "versionStartIncluding": "5.9.12",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "5.10.253",
            "versionStartIncluding": "5.10.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "5.15.203",
            "versionStartIncluding": "5.11",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.1.167",
            "versionStartIncluding": "5.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.6.130",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.12.78",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.18.19",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.19.9",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:-:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc5:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc6:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.10:rc7:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 7.1 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H; source: NVD: nvd@nist.gov

- CISA KEV: No listing in collected sources

- EPSS: 0.13% as of 2026-11-06; percentile 2.33%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-125

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71 (CNA: Linux)

- https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c (CNA: Linux)

- https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e (CNA: Linux)

- https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f (CNA: Linux)

- https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9 (CNA: Linux)

- https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7 (CNA: Linux)

- https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e (CNA: Linux)

- https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516 (CNA: Linux)

- https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-43449; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-43449; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-43449; retrieved 2026-11-06; source updated Not reported

Revision: 6730c1455cb11809261070e2b14e994e5fab37983d9207e5e0a50cbc2e1ead95

Canonical: https://y2.dev/cve/CVE-2026-43449

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.