CVE-2026-74361

nvme: fix FDP fdpcidx bounds check

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix FDP fdpcidx bounds check

The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1).

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	30b5f20bb2ddab013035399e5c7e6577da49320a to before 5e406928404d67a8da8aa3ae21732e1ea1a04118Affected 30b5f20bb2ddab013035399e5c7e6577da49320a to before 5d0e7d2af884b91329235abb16652ae4eead8079Affected 30b5f20bb2ddab013035399e5c7e6577da49320a to before 0967074f6830718fd2597404ef119bddd0dbfd00Affected
LinuxLinux	6.16Affected before 6.16Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.