CVE-2026-97433 (GCVE-0-2026-97433)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:44
VLAI
Title
nvme: validate FDP configuration descriptor sizes
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 30b5f20bb2ddab013035399e5c7e6577da49320a , < 97efd7a41aac08b43ea2337c5913a2bc75484f9f (git)
Affected: 30b5f20bb2ddab013035399e5c7e6577da49320a , < 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97efd7a41aac08b43ea2337c5913a2bc75484f9f",
              "status": "affected",
              "version": "30b5f20bb2ddab013035399e5c7e6577da49320a",
              "versionType": "git"
            },
            {
              "lessThan": "0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8",
              "status": "affected",
              "version": "30b5f20bb2ddab013035399e5c7e6577da49320a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: validate FDP configuration descriptor sizes\n\nValidate descriptor sizes while walking the FDP configurations log so\ndsze == 0 or a descriptor past the log end cannot cause unbounded\niteration or reads past the buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nvme_query_fdp_granularity() walks nvme_fdp_config_desc.dsze from the Get Log Page LID 0x20 (NVME_LOG_FDP_CONFIGS) buffer filled by nvme_get_log_lsi(); on nvme-tcp that payload is C2HData copied by nvme_tcp_recv_data() from the remote NVMe-oF target (TCP 4420), so the malformed descriptor sizes arrive on the wire.\nAC:L - The peer sets Identify ctratt NVME_CTRL_ATTR_FDPS, Get Features FID 0x1d (FDPE and fdpcidx), and log fields sze/dsze, so nvme_query_fdp_granularity() can skip with a crafted dsze to park desc just below end and then load nrg/runs past the kvmalloc object with no race.\nPR:N - The attacker is the NVMe-oF controller. nvme_scan_work() submits that Get Log Page on the existing admin_q; DH-HMAC-CHAP and TLS are optional, and no host uid, capability, or /dev/nvme-fabrics write is required once the session exists.\nUI:N - nvme_start_ctrl() queues ctrl-\u003escan_work and nvme_handle_aen_notice() requeues it on NVME_AER_NOTICE_NS_CHANGED, so nvme_scan_ns()-\u003envme_update_ns_info_block()-\u003envme_query_fdp_info()-\u003envme_query_fdp_granularity() runs on nvme_wq without a further victim mount or click.\nS:U - The over-read is of the host kvmalloc FDP configs log and the info-\u003eruns store inside nvme_query_fdp_granularity(); it does not cross a KVM/Xen, IOMMU, or other distinct security authority.\nC:L - After the dsze walk, nvme_query_fdp_granularity() only does le32_to_cpu(desc-\u003enrg) and le64_to_cpu(desc-\u003eruns) (offsets 4 and 16). With desc at end-1 that is a strictly bounded 12-byte load past the log object, a small heap leak rather than an arbitrary read.\nI:N - Those fields are stored to info-\u003eruns and min()\u0027d into write_stream_granularity in nvme_update_ns_info_block(); the dsze walk performs no out-of-bounds write, use-after-free, or control-flow hijack.\nA:H - hdr.sze is attacker-chosen (capped at PAGE_SIZE*MAX_ORDER_NR_PAGES) for kvmalloc(), and desc-\u003enrg/desc-\u003eruns are then loaded without ensuring the selected descriptor fits; that over-read past the allocation can oops when the walk parks desc at the buffer end."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:44:10.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97efd7a41aac08b43ea2337c5913a2bc75484f9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8"
        }
      ],
      "title": "nvme: validate FDP configuration descriptor sizes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97433",
    "datePublished": "2026-09-24T16:03:46.169Z",
    "dateReserved": "2026-09-24T14:53:16.869Z",
    "dateUpdated": "2026-09-25T12:44:10.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97433",
      "date": "2026-09-26",
      "epss": "0.00319",
      "percentile": "0.22296"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "97efd7a41aac08b43ea2337c5913a2bc75484f9f",
                    "status": "affected",
                    "version": "30b5f20bb2ddab013035399e5c7e6577da49320a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8",
                    "status": "affected",
                    "version": "30b5f20bb2ddab013035399e5c7e6577da49320a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: validate FDP configuration descriptor sizes\n\nValidate descriptor sizes while walking the FDP configurations log so\ndsze == 0 or a descriptor past the log end cannot cause unbounded\niteration or reads past the buffer."
          }
        ],
        "id": "CVE-2026-97433",
        "lastModified": "2026-09-25T13:17:26.930",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:21.350",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/97efd7a41aac08b43ea2337c5913a2bc75484f9f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-25T23:47:30Z",
      "cve": "CVE-2026-97433",
      "id": "CVE-2026-97433",
      "initial_release_date": "2026-09-24T23:46:10Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-97433",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-97433.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.