CVE-2026-74361
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, a vulnerability in the NVMe driver has been fixed regarding an incorrect bounds check for the fdpcidx index in the FDP (Flexible Data Placement) mechanism. The bug used > instead of >=, incorrectly accepting an index equal to NUMFDPC + 1.
Risk Assessment
The vulnerability could lead to out-of-bounds access, potentially causing system crashes or privilege escalation in environments with FDP-capable NVMe controllers.
Recommendation
Update the Linux kernel to a patched version and test NVMe drives with FDP functionality.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1).