CVE-2026-98153: nvme: fix racy access to FDP placement id array
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix racy access to FDP placement id array
nvmequeryfdpinfo() is called per-path and therefore prone to races.
It populates head->nrplids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it.
Avoid the race by moving this initialization work to nvmeallocnshead() which is called once per shared namespace.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this race condition?
Systems using the Linux kernel NVMe subsystem with a shared namespace reachable through multiple paths are exposed, because FDP placement ID initialization previously occurred per path. The race requires two paths to scan the same namespace concurrently.
What change resolves the issue?
The fix moves FDP placement ID initialization from the per-path nvme_query_fdp_info() flow to nvme_alloc_ns_head(), which runs once for the shared namespace. This prevents concurrent paths from racing while populating head->nr_plids and head->plids.