The Linux kernel nvme-pci driver had a vulnerability (CVE-2026-74383) where the function nvme_setup_descriptor_pools indexed the descriptor_pools array using an unsigned parameter derived from hctx->numa_node. On non-NUMA kernels, hctx->numa_node is NUMA_NO_NODE (-1), which as unsigned becomes UINT_MAX, causing an out-of-bounds access. This leads to a kernel page fault during nvme_alloc_ns() and prevents the creation of the /dev node for the namespace. The fix involves changing the parameter to a signed int and falling back to node 0 when NUMA_NO_NODE is encountered, ensuring safe indexing.

This vulnerability causes a kernel page fault on non-NUMA Linux kernels when probing NVMe controllers, resulting in failure to create device nodes for NVMe namespaces. This can disrupt normal NVMe device operation and potentially affect system stability or device accessibility. There is no indication of code execution or privilege escalation from the provided data.

A fix is available that changes the parameter type to signed int and defaults to node 0 when the NUMA node is invalid. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official patch and update guidance.