Executive brief
The Linux kernel's NVMe driver contains an off-by-one error in bounds checking for Flexible Data Placement (FDP) queue indices. This allows an attacker to pass an out-of-bounds FDP index that should be rejected, potentially leading to memory corruption or unauthorized access to storage device functionality. Systems using NVMe drives with FDP support are affected.
Technical details
The vulnerability is an off-by-one error in the NVMe FDP (Flexible Data Placement) bounds check within `drivers/nvme/host/core.c`, function `nvme_query_fdp_granularity()`. The code sets n = NUMFDPC + 1 (the maximum valid index) but uses a `>` operator instead of `>=` to validate fdp_idx, allowing an index equal to NUMFDPC + 1 to bypass the check. An attacker with local access or ability to control NVMe command parameters can supply an out-of-bounds FDP index, potentially causing out-of-bounds memory access, information disclosure, or device state corruption. The fix changes the comparison from `if (fdp_idx > n)` to `if (fdp_idx >= n)`. Patches are available in upstream Linux kernel commits and stable releases.
Affected products
- Linux Linux kernel 5.0 and later (FDP support introduced in Linux 5.19+)
Timeline
- 2026-08-15: disclosed
- 2026-06-02: patched: Upstream fix committed (0967074f6830718fd2597404ef119bddd0dbfd00)
- 2026-07-24: patched: Stable tree backport