Description

In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-24T17:17:21.350Z",
  "pubdate": "2026-09-24T17:17:21.350Z",
  "executiveSummary": "The Linux kernel NVMe driver contains an input validation vulnerability within the Flexible Data Placement (FDP) configuration log parsing logic.\nThis vulnerability is classified as an out-of-bounds read/infinite loop, triggered when processing malformed FDP configuration descriptors.\nThe flaw affects the NVMe subsystem, specifically impacting drivers that handle device-provided FDP descriptor logs.\nA malicious or compromised NVMe device can exploit this by providing manipulated descriptor sizes (dsze), leading to memory corruption, potential kernel panic (Denial of Service), or the leakage of sensitive kernel memory.\nThe risk is critical in virtualized or multi-tenant environments where guest access to hardware interfaces might be mediated or where physical device integrity cannot be guaranteed.\nExploitation does not necessarily require user-space authentication if the attacker can influence the device-to-host communication or present a malicious NVMe device to the system.",
  "technicalDetails": "The vulnerability resides in the routine responsible for traversing the FDP (Flexible Data Placement) configuration log retrieved from an NVMe device.\nThe root cause is a lack of rigorous validation regarding the 'dsze' (descriptor size) field provided within the configuration descriptors. When the kernel parses the log, it iterates through descriptors based on the sizes specified in the device response.\nIf 'dsze' is reported as zero, the iteration logic fails to increment the pointer correctly, potentially resulting in an infinite loop that stalls the kernel thread, leading to a system-wide Denial of Service (DoS).\nFurthermore, if a malformed descriptor reports an excessively large size that causes the total descriptor length to exceed the actual buffer size, the kernel performs an out-of-bounds read. This allows an attacker-controlled NVMe device to force the kernel to access memory segments beyond the allocated heap buffer.\nThe attack flow begins when the kernel initializes an NVMe device that supports FDP. Upon requesting the FDP configuration log, the device returns a crafted response. The kernel driver, assuming the integrity of the device data, proceeds to iterate through the list of configurations. By injecting a descriptor with a zero-length or a length exceeding the log boundary, the attacker triggers the vulnerability during the parsing phase.\nBecause this parsing occurs within the kernel context, an out-of-bounds read can potentially expose kernel stack or heap data if the contents of the memory being read are subsequently logged or processed in a way that returns the information to user space.\nThe vulnerable code path is strictly located within the NVMe subsystem of the Linux kernel, specifically the FDP configuration parsing logic. As this occurs during the hardware initialization or feature configuration phase, it requires the kernel to be actively communicating with the malicious NVMe device.\nThere are no specific privilege requirements for the attacker if they can present a malicious hardware device, as the driver is programmed to automatically process these descriptors during standard device discovery and initialization sequences."
}