The Linux kernel NVMe driver function nvme_setup_discard() always maps a fixed-size discard payload buffer. Normally, this buffer is zeroed by kzalloc(), but if that allocation fails under memory pressure, the code falls back to using a per-controller discard_page allocated by alloc_page(), which is not zeroed. This can cause uninitialized memory (up to 4080 bytes) to be sent to the NVMe controller. The vulnerability was identified through KMSAN detection of uninitialized memory usage. The fix involves allocating the fallback page with __GFP_ZERO to ensure it is zeroed before use, preventing leakage of kernel memory contents.

Under rare conditions of memory allocation failure, uninitialized kernel memory could be leaked to the NVMe controller during discard commands. This leakage is limited to the fallback discard page buffer and requires specific memory pressure conditions to trigger. There is no indication of remote exploitability or active exploitation in the wild.

A fix is available that zeroes the fallback discard page allocation by using __GFP_ZERO. Systems should apply the official Linux kernel patch that includes this fix. No additional mitigation is required as the vulnerability is addressed by this patch.