CVE-2026-97433

A flaw of moderate impact was found in the Linux kernel's NVMe driver as shipped in Red Hat Enterprise Linux. When processing Flexible Data Placement (FDP) configuration log descriptors returned by an NVMe controller, the driver failed to validate descriptor sizes, so a descriptor with a zero size (dsze == 0) or a descriptor extending past the end of the log buffer could cause unbounded iteration or out-of-bounds reads. This can lead to a kernel hang, soft lockup, or kernel panic, resulting in a denial of service; no memory corruption or integrity impact occurs. Exploitation requires a malicious or faulty NVMe device supplying crafted FDP configuration log data, and attaching or configuring NVMe devices (including NVMe-over-Fabrics targets) requires local administrative privileges on the host. For this reason Red Hat rates this flaw moderate (CVSS 5.5, AV:L/PR:L/C:N/I:N/A:H), which differs from the upstream CVEORG score of 8.2 that assumes a network attack vector with no privileges required. The vulnerable FDP configuration log handling is present only in newer kernels: Red Hat Enterprise Linux 9.8.z, 9.9, and 9.10, Red Hat Enterprise Linux 10.2.z, 10.3, and 10.4, Red Hat In-Vehicle OS 2.0 and 2.1, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 are affected. Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 and 10 streams, and earlier OpenShift 4.x streams are not affected because the vulnerable code is not present in those versions. The fix has been deferred for the affected streams and will be addressed in a future update; the residual risk until then is denial of service on hosts where an attacker with administrative control can supply crafted FDP configuration log data from a connected NVMe device.