A critical out-of-bounds access vulnerability in the Linux kernel NVMe subsystem allows unauthenticated attackers to potentially cause system-wide disruption.

The vulnerability exists in the Flexible Data Placement (FDP) fdpcidx bounds check within the NVMe subsystem. The code performs an incorrect comparison that allows out-of-bounds access, which can be triggered by an unauthenticated attacker, according to the CVSS vector.

With a CVSS score of 9.8, this vulnerability is critical. An attacker can remotely trigger a kernel-level out-of-bounds access, leading to potential system crashes, memory corruption, or complete host failure, which poses a severe risk to mission-critical infrastructure.

Immediate Action: Update the Linux kernel to version 6.18.40, 7.1.5, or later.

Proactive Monitoring: Review network traffic and system logs for unusual NVMe command patterns or unexpected system reboots.

Compensating Controls: Implement network-level segmentation to limit exposure of storage subsystems to untrusted network segments.

Public Exploit Available: false

Due to the critical severity and the potential for unauthenticated exploitation, this update should be applied with high urgency. Organizations operating hardware that utilizes the NVMe FDP feature should verify their kernel versions immediately and deploy the patched releases.