EUVD-2026-59508
GHSA-597p-qxfw-c3vg
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reaching the FDP path needs the ability to issue NVMe commands (PR:L) with FDP in use and a crafted index (AC:H); impact is chiefly out-of-bounds kernel memory read (C:H) with possible crash (A:L), not integrity loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix FDP fdpcidx bounds check
The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1).
AnalysisAI
Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the NVMe FDP (Flexible Data Placement) code path to be present and reachable, and the ability to submit an NVMe command carrying an attacker-chosen fdpcidx (FDP configuration index) equal to NUMFDPC + 1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be reconciled before prioritizing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker able to submit NVMe commands to a vulnerable host - either a local process with access to the NVMe device or a connected NVMe-over-Fabrics initiator - supplies an fdpcidx equal to NUMFDPC + 1, which the flawed check accepts. The kernel then indexes one entry past the FDP configuration array, reading adjacent kernel memory that may leak sensitive data or destabilize the kernel. … |
| Remediation | Upgrade to a patched stable kernel - Vendor-released patch: 6.18.40, 7.1.5, or 7.2-rc1 (or your distribution's build incorporating the corresponding stable commit 5e406928404d / 5d0e7d2af884 / 0967074f6830 from git.kernel.org). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running affected Linux versions 6.16 and later with NVMe FDP enabled and prioritize based on data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today