CVE-2026-74361

A flaw was found in the NVMe (Non-Volatile Memory Express) subsystem of the Linux kernel. An incorrect bounds check in the Flexible Data Placement (FDP) fdpcidx function allows an out-of-bounds access. This occurs because the check incorrectly accepts an index value that is beyond the intended boundary. This vulnerability could potentially lead to system instability or other unspecified impacts.

An off by one bounds check in the NVMe FDP host path can accept fdp_idx equal to NUMFDPC plus 1 instead of rejecting it. A malicious or faulty NVMe controller can make the host use an invalid FDP configuration index, which may lead to an out of bounds read of FDP configuration data or incorrect block layer FDP stream registration. For the CVSS the PR:N is used in the paranoid score because the attacker does not need a local account on the host if they control a reachable NVMe controller or storage fabric endpoint. The issue is not Internet remote in the usual deployment model and is best treated as adjacent network or device reachable. Impact is at least reliability degradation or denial of service. In the paranoid view, limited confidentiality or integrity impact is kept because the bug class is an invalid bounds check in host parsing of controller supplied data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.