CVE-2026-97433: nvme: validate FDP configuration descriptor sizes
Published Sep 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
nvme: validate FDP configuration descriptor sizes
Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 24, 2026
CVE Published
via MITRE·04:03 PM
Data Sourced
via MITRE·04:03 PM
Description
Data Sourced
via NVD·05:17 PM
DescriptionSeverity
Frequently Asked Questions
1
What condition is required to trigger the flaw?
The FDP configurations log must contain a descriptor with a zero size or a size that causes the descriptor to extend past the end of the log buffer. This can result in unbounded iteration or reads beyond the buffer.
2
Are fixes available for downstream stable kernel trees?
The provided references identify stable kernel commits 97efd7a41aac08b43ea2337c5913a2bc75484f9f and 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8. No affected or fixed kernel version ranges are provided.