CVE-2026-74384

CVE-2026-74384 is a real memory corruption bug — a KASAN-confirmed slab-out-of-bounds write in the NVMe multipath path revalidation code during device initialization. The vulnerability is real. What deserves scrutiny is whether the 9.8 CVSS score correctly characterizes the actual risk profile. The trigger condition is narrow: sparse NUMA node IDs on PowerPC architectures. On x86_64 systems, where node IDs are typically sequential, this bug does not fire — the allocation is correctly sized. The kernel allocates based on `num_possible_nodes()` when it should use `nr_node_ids`, and this mismatch only manifests on architectures where node IDs are not contiguous. That means the vast majority of deployed systems have a silent corruption vulnerability rather than an exploitable one. But here's what the CVSS misses: the blast radius on systems where it does trigger is severe. The corruption occurs in a kmalloc-2048 cache during storage subsystem initialization. Adjacent objects could include structures with function pointers, reference counts, or queue pointers — turning an out-of-bounds write into a controlled write primitive. Worse, on x86_64 production kernels (where KASAN is disabled), the same bug fires silently, corrupts adjacent slab objects, and may only surface as a delayed failure during I/O pressure, a misdiagnosed firmware issue, or data integrity loss that never gets traced back to NUMA assumptions. The fix — allocating `nr_node_ids` entries instead of `num_possible_nodes()` — is correct but imposes persistent memory overhead (48 bytes versus potentially 256-512 entries). That trade-off is worth accepting, but it exposes a deeper problem: the kernel's NUMA allocation APIs provide two semantically different answers to the same developer question without clear guidance on which to use. Triage priorities: audit all flexible array members indexed by `numa_node_id()` in your kernel builds, particularly in storage, networking, and firmware subsystems. Check whether any use `num_possible_nodes()` as the allocation size multiplier. On production x86_64 systems, treat this as a latent data integrity risk rather than an immediately triggerable vulnerability — the absence of KASAN means silent corruption is the more likely manifestation. The 9.8 score likely overstates trigger accessibility but understates consequences for affected systems.

Reviewed through automated stages and approved by a human before publication.