All vulnerabilities
CVE-2026-97433

Linux: nvme: validate FDP configuration descriptor sizes

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in97efd7a41aac08b43ea2337c5913a2bc75484f9fAlso 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8CVE List
Published24 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

  • 97efd7a41aac08b43ea2337c5913a2bc75484f9fLinuxCVE List
  • 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: validate FDP configuration descriptor sizes

Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.

Text from CVE List

Affected versions 6

  • Linuxaffected: 30b5f20bb2ddab013035399e5c7e6577da49320a before 97efd7a41aac08b43ea2337c5913a2bc75484f9fCVE List
  • Linuxaffected: 30b5f20bb2ddab013035399e5c7e6577da49320a before 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8CVE List
  • Linuxaffected: 6.16CVE List
  • Linuxunaffected: all versions before 6.16CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 2