CVE-2026-74383

CVE-2026-74383 is a type-contract failure at an API boundary. The `numa_node` parameter in `nvme_setup_descriptor_pools()` is declared unsigned, but its caller passes `hctx->numa_node`, which can legitimately be `NUMA_NO_NODE` (-1) on kernels compiled without CONFIG_NUMA. When -1 lands in an unsigned parameter, it becomes UINT_MAX—a value that faults immediately when used as an array index. The bug manifests only under CONFIG_NUMA=n, which is precisely the configuration least likely to be exercised during development. Enterprise and distro kernels almost universally enable NUMA, so this regression likely escaped testing on the systems where developers run their code. The non-NUMA path became untested edge case, and a single probing event during `nvme_alloc_ns()` triggers the fault. The real failure isn't algorithmic—it's a documentation and type-contract gap. The parameter type `unsigned int` semantically suggests non-negative values, but practical NUMA APIs require representing 'no node assigned.' Declaring the parameter unsigned didn't just fail to communicate this; it actively corrupted the sentinel value into a faulting index. The fix (change to int, fallback to node 0) is mechanically simple, which exposes that this is a systemic gap in how the kernel enforces API contracts at configuration boundaries. Your immediate actions: verify your kernel's CONFIG_NUMA setting if you're running NVMe storage on non-NUMA configurations (embedded systems, containers, cloud VMs with NUMA disabled). Check whether the nvme driver is logging initialization failures that might indicate this path. For kernel developers, the deeper question is how many similar type-contract violations exist in driver code where non-NUMA or similar configuration paths aren't exercised in CI—the pattern of signed/unsigned sentinel corruption has recurred across signal APIs, NUMA topology lookups, and CPU mask operations. The kernel's build system should surface these mismatches; the fact that it didn't points to a gap in cross-configuration type checking that likely affects other subsystems.

Reviewed through automated stages and approved by a human before publication.