CVE-2026-89965

The Linux kernel's NVDIMM Block Translation Table (BTT) driver reads the nfree field of the arena info block from the persistent-memory medium without validating it, and sizes the per-lane freelist[] and rtt[] arrays by that untrusted value, while the I/O path indexes those arrays with a lane number bounded only by the region's lane count (ND_MAX_LANES). An attacker who supplies a crafted or foreign arena whose nfree is below the lane count causes freelist[lane]/rtt[lane] to run past the end of the allocation, producing an out-of-bounds write in kernel memory. Given the CVSS vector (local attack, low privileges, no user interaction), this can lead to kernel memory corruption with high-impact confidentiality, integrity, and availability consequences such as privilege escalation or system crashes. Only systems running Linux kernels with the nvdimm BTT driver enabled and NVDIMM/persistent-memory hardware (or an emulated equivalent) presenting such an arena are affected. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV.

What to do: Update to a vendor kernel that includes the nvdimm/btt fix rejecting arenas whose nfree is below the lane count (check your distribution's kernel advisory for the specific fixed build). Until patched, restrict local unprivileged access on NVDIMM-equipped systems and avoid attaching or mounting BTT namespaces created from untrusted or foreign media. Administrators can use ndctl to check whether any namespaces actually run in BTT mode; hosts without NVDIMM hardware or the BTT driver are not affected.