Linux kernel (drivers/nvme/host): An off-by-one in the Flexible Data Placement index check accepts a placement index

Impact

An off-by-one in the Flexible Data Placement index check accepts a placement index one past the end of the configuration array, so a value that came from userspace is used to read out of bounds in the I/O submission path. The tenant supplying the index gets an out-of-bounds read of adjacent kernel memory and, at minimum, a node-destabilising fault.

Who can reach it

Reachable by an unprivileged process on the node that can issue I/O to an FDP-capable NVMe namespace and set the write placement hint - no /dev/nvme passthrough or CAP_SYS_ADMIN needed, since the placement index rides on ordinary writes. Conditional on the namespace having FDP enabled, which is increasingly common on modern datacenter SSDs used for tenant scratch space.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: disable FDP on namespaces exposed to tenants, or do not hand tenants direct block devices on FDP-enabled drives until the node is patched.

References