CVE-2026-97433 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
nvme: validate FDP configuration descriptor sizes
Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The identified vulnerability resides within the Non-Volatile Memory Express (NVMe) subsystem of the Linux kernel, specifically affecting the handling of Fault Detection and Prediction (FDP) configuration descriptors. The NVMe specification defines various logs that provide detailed information about device capabilities and status, including FDP logs which describe how a storage controller manages fault detection mechanisms such as power loss protection or data integrity checks. When the operating system queries these logs to configure the driver's behavior, it must parse variable-length descriptor structures contained within the log buffer. The core technical flaw involves insufficient validation of the size fields within these descriptors during iteration. Specifically, the code previously failed to rigorously verify that the declared size of a descriptor (dsze) was valid or zero before proceeding to access subsequent data. This lack of strict boundary checking creates a scenario where malformed or maliciously crafted log responses from an NVMe device can lead to unbounded loop iterations and out-of-bounds memory reads.
From a technical perspective, this flaw constitutes a classic buffer over-read vulnerability. When the kernel walks through the FDP configuration log, it relies on cumulative offsets calculated by adding descriptor sizes together. If a descriptor reports an excessively large size or if the logic fails to account for the total length of the log data versus the sum of individual descriptor sizes, the iteration loop may continue past the allocated buffer boundary. This results in reading kernel memory that does not belong to the NVMe driver's context. Such out-of-bounds reads can expose sensitive kernel information to user space if the retrieved data is subsequently copied back via ioctl calls or other interfaces. Furthermore, depending on how the invalid size interacts with subsequent logic, it could potentially lead to integer overflows in offset calculations, further exacerbating the risk of accessing unauthorized memory regions.
The operational impact of this vulnerability varies based on the attack vector and system configuration. If an attacker has physical access to the machine or control over a virtualized NVMe device passed through via PCI passthrough, they can present a maliciously crafted FDP log response during initialization or query operations. This allows for information disclosure, where kernel memory contents are leaked, potentially revealing cryptographic keys, passwords, or other sensitive data stored in adjacent memory pages. In more severe scenarios involving complex interaction with the driver's state machine, this flaw could contribute to denial of service conditions by causing kernel panics due to invalid memory access violations. The severity is heightened because NVMe drivers operate at a low level within the kernel stack, making them attractive targets for local privilege escalation or system destabilization attacks that require minimal user interaction beyond device attachment.
This vulnerability aligns with CWE-125 (Out-of-bounds Read) and falls under the ATT&CK technique of T1083 (File and Directory Discovery), as it involves accessing file-like structures within the kernel to gather information about system capabilities, although the primary risk is memory safety rather than just discovery. Mitigation strategies primarily involve applying the upstream Linux kernel patches that enforce strict validation of descriptor sizes before processing them. System administrators should ensure their systems are updated with the latest stable kernel versions containing this fix. Additionally, organizations deploying NVMe storage in untrusted environments or virtualized contexts should consider implementing hardware-level protections and monitoring for anomalous device behavior during initialization phases to detect potential exploitation attempts that attempt to trigger these parsing errors.