Linux kernel (drivers/nvme/host): An off-by-one in the Flexible Data Placement index check accepts a placement index

CVSS 9.8CVE-2026-74361Kernel, userspace & hypervisorcurated

Impact

An off-by-one in the Flexible Data Placement index check accepts a placement index one past the end of the configuration array, so a value that came from userspace is used to read out of bounds in the I/O submission path. The tenant supplying the index gets an out-of-bounds read of adjacent kernel memory and, at minimum, a node-destabilising fault.

Who can reach it

Reachable by an unprivileged process on the node that can issue I/O to an FDP-capable NVMe namespace and set the write placement hint - no /dev/nvme passthrough or CAP_SYS_ADMIN needed, since the placement index rides on ordinary writes. Conditional on the namespace having FDP enabled, which is increasingly common on modern datacenter SSDs used for tenant scratch space.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: disable FDP on namespaces exposed to tenants, or do not hand tenants direct block devices on FDP-enabled drives until the node is patched.

References

https://git.kernel.org/stable/c/5e406928404d67a8da8aa3ae21732e1ea1a04118 https://git.kernel.org/stable/c/5d0e7d2af884b91329235abb16652ae4eead8079 https://nvd.nist.gov/vuln/detail/CVE-2026-74361

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.