---
id: CVE-2022-50756
title: 'nvme-pci: fix mempool alloc size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-pci: fix mempool alloc size

  Convert the max size to bytes to match the units of the divisor that
  calculates the worst-case number of PRP entries.

  The result is u…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    dfb6d54893d544151e7f480bc44cfe7823f5ad23
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    9141144b37f30e3e7fa024bcfa0a13011e546ba9
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    e1777b4286e526c58b4ee699344b0ad85aaf83a0
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    b1814724e0d7162bdf4799f2d565381bc2251c63
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    c89a529e823d51dd23c7ec0c047c7a454a428541
  - Linux 4.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:32:29.362408Z'
published: '2025-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:23.908Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50756'
references:
  - url: 'https://git.kernel.org/stable/c/dfb6d54893d544151e7f480bc44cfe7823f5ad23'
  - url: 'https://git.kernel.org/stable/c/9141144b37f30e3e7fa024bcfa0a13011e546ba9'
  - url: 'https://git.kernel.org/stable/c/e1777b4286e526c58b4ee699344b0ad85aaf83a0'
  - url: 'https://git.kernel.org/stable/c/b1814724e0d7162bdf4799f2d565381bc2251c63'
  - url: 'https://git.kernel.org/stable/c/c89a529e823d51dd23c7ec0c047c7a454a428541'
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.09323
ingestedAt: '2026-10-15T22:48:25.382Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix mempool alloc size

Convert the max size to bytes to match the units of the divisor that
calculates the worst-case number of PRP entries.

The result is used to determine how many PRP Lists are required. The
code was previously rounding this to 1 list, but we can require 2 in the
worst case. In that scenario, the driver would corrupt memory beyond the
size provided by the mempool.

While unlikely to occur (you'd need a 4MB in exactly 127 phys segments
on a queue that doesn't support SGLs), this memory corruption has been
observed by kfence.

## Affected

- `Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd < dfb6d54893d544151e7f480bc44cfe7823f5ad23`
- `Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd < 9141144b37f30e3e7fa024bcfa0a13011e546ba9`
- `Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd < e1777b4286e526c58b4ee699344b0ad85aaf83a0`
- `Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd < b1814724e0d7162bdf4799f2d565381bc2251c63`
- `Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd < c89a529e823d51dd23c7ec0c047c7a454a428541`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.