Linux Kernel EUVD-2026-86046

Requires the host to be connected to an attacker-controlled or compromised NVMe controller that advertises FDP (Flexible Data Placement) capability, since the trigger is a maliciously crafted FDP configurations log (a descriptor with dsze==0 or one positioned past the log's end). Exploitation is limited to systems using an NVMe device whose FDP configurations log is parsed by the kernel; it is not reachable purely over a network despite the AV:N rating, and typically requires physical device substitution, tampered device firmware, or an emulated NVMe device in a virtualization/passthrough scenario. Only kernels prior to 6.18.53 (and the 7.x line before 7.2) are affected.

The input assigns CVSS 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H (availability-dominant, minor confidentiality). However, the technical nature contradicts AV:N: the flaw is in the kernel NVMe driver while walking the FDP (Flexible Data Placement) configurations log returned by the storage controller. The malicious input - a descriptor with dsze==0 or one extending past the log buffer end - originates from the NVMe device/controller, not a network peer. This is a device-to-host trust-boundary bug, effectively local (AV:L) or physical/virtualization-passthrough reach, so the AV:N rating and the resulting 8.2 base score materially overstate remote reachability. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so real-world exploitation pressure is low. The dominant impact is unbounded iteration / reads past the buffer → kernel crash/DoS (A:H), with at most limited information exposure (C:L). This is a defensive hardening/robustness fix typical of the Linux kernel stable stream rather than a high-priority remotely-exploitable vulnerability. Conflict to verify: CVSS network vector vs. description implying a malicious/compromised NVMe controller supplying the crafted FDP log - attack vector should be re-evaluated as local.

A malicious or compromised NVMe controller (e.g., firmware-tampered device, or an emulated NVMe device exposed to a guest in a virtualization/passthrough setup) advertises FDP support and returns a crafted FDP configurations log containing a descriptor with dsze==0 or one that extends past the declared log length. When the Linux kernel parses this log it iterates unbounded or reads past the buffer, crashing the host or leaking adjacent kernel memory. No public exploit code is identified at time of analysis.