CVE-2026-97433

A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver. When processing Flexible Data Placement (FDP) configuration log descriptors, the driver fails to properly validate descriptor sizes before iterating through them. A malicious NVMe device returning crafted log data can exploit this issue to cause unbounded loops or out-of-bounds memory reads, leading to a Denial of Service (DoS) or potential information disclosure.

A flaw of moderate impact was found in the Linux kernel's NVMe driver as shipped in Red Hat Enterprise Linux. When processing Flexible Data Placement (FDP) configuration log descriptors returned by an NVMe controller, the driver failed to validate descriptor sizes, so a descriptor with a zero size (dsze == 0) or a descriptor extending past the end of the log buffer could cause unbounded iteration or out-of-bounds reads. This can lead to a kernel hang, soft lockup, or kernel panic, resulting in a denial of service; no memory corruption or integrity impact occurs. Exploitation requires a malicious or faulty NVMe device supplying crafted FDP configuration log data, and attaching or configuring NVMe devices (including NVMe-over-Fabrics targets) requires local administrative privileges on the host. For this reason Red Hat rates this flaw moderate (CVSS 5.5, AV:L/PR:L/C:N/I:N/A:H), which differs from the upstream CVEORG score of 8.2 that assumes a network attack vector with no privileges required. The vulnerable FDP configuration log handling is present only in newer kernels: Red Hat Enterprise Linux 9.8.z, 9.9, and 9.10, Red Hat Enterprise Linux 10.2.z, 10.3, and 10.4, Red Hat In-Vehicle OS 2.0 and 2.1, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 are affected. Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 and 10 streams, and earlier OpenShift 4.x streams are not affected because the vulnerable code is not present in those versions. The fix has been deferred for the affected streams and will be addressed in a future update; the residual risk until then is denial of service on hosts where an attacker with administrative control can supply crafted FDP configuration log data from a connected NVMe device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.