CVE-2026-98153

A flaw was found in the Linux kernel's NVMe driver. A race condition can lead to a denial of service (DoS) or memory corruption when multiple paths scan the same shared namespace concurrently. Because access to the Flexible Data Placement (FDP) configuration data is unprotected during initialization, concurrent operations can corrupt internal data structures, allowing a local user to destabilize or crash the system.

A low-impact race condition flaw was found in the Linux kernel's NVMe driver, affecting the kernel in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 kernel shipped with OpenShift Container Platform 4.22 and later. When an NVMe namespace is shared across multiple paths, nvme_query_fdp_info() is called per path and populates the namespace head's Flexible Data Placement (FDP) placement ID array (head->nr_plids/head->plids) without synchronization. Two paths scanning the same shared namespace concurrently can race to populate this pair, leaving inconsistent FDP state or leaked allocations and potentially allowing a local user to destabilize or crash the system. The impact is rated low because exploiting the flaw requires a multipath NVMe configuration with FDP-capable hardware and winning a timing-dependent race during namespace discovery. Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 and RHEL 10 update streams, and OpenShift Container Platform releases prior to 4.22 are not affected because the vulnerable FDP registration code is not present in those kernels. For the affected streams the fix is deferred given the low impact and constrained exploitability; the residual risk is limited to denial of service or corruption of internal kernel FDP data structures on multipath NVMe systems until a fix is delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.