CVE-2026-74361 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0967074f6830718fd2597404ef119bddd0dbfd00
https://git.kernel.org/stable/c/5d0e7d2af884b91329235abb16652ae4eead8079
https://git.kernel.org/stable/c/5e406928404d67a8da8aa3ae21732e1ea1a04118

History

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1).
Title		nvme: fix FDP fdpcidx bounds check
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0967074f6830718fd2597404ef119bddd0dbfd00 https://git.kernel.org/stable/c/5d0e7d2af884b91329235abb16652ae4eead8079 https://git.kernel.org/stable/c/5e406928404d67a8da8aa3ae21732e1ea1a04118

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:44.857Z

Updated: 2026-08-15T05:58:44.857Z

Reserved: 2026-08-15T05:44:03.887Z

Link: CVE-2026-74361

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:37.677

Modified: 2026-08-15T06:22:37.677

Link: CVE-2026-74361

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74361", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.887Z", "datePublished": "2026-08-15T05:58:44.857Z", "dateUpdated": "2026-08-15T05:58:44.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T05:58:44.857Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix FDP fdpcidx bounds check\n\nThe fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=,\nincorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/core.c"], "versions": [{"version": "30b5f20bb2ddab013035399e5c7e6577da49320a", "lessThan": "5e406928404d67a8da8aa3ae21732e1ea1a04118", "status": "affected", "versionType": "git"}, {"version": "30b5f20bb2ddab013035399e5c7e6577da49320a", "lessThan": "5d0e7d2af884b91329235abb16652ae4eead8079", "status": "affected", "versionType": "git"}, {"version": "30b5f20bb2ddab013035399e5c7e6577da49320a", "lessThan": "0967074f6830718fd2597404ef119bddd0dbfd00", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/core.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5e406928404d67a8da8aa3ae21732e1ea1a04118"}, {"url": "https://git.kernel.org/stable/c/5d0e7d2af884b91329235abb16652ae4eead8079"}, {"url": "https://git.kernel.org/stable/c/0967074f6830718fd2597404ef119bddd0dbfd00"}], "title": "nvme: fix FDP fdpcidx bounds check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5e406928404d67a8da8aa3ae21732e1ea1a04118", "status": "affected", "version": "30b5f20bb2ddab013035399e5c7e6577da49320a", "versionType": "git"}, {"lessThan": "5d0e7d2af884b91329235abb16652ae4eead8079", "status": "affected", "version": "30b5f20bb2ddab013035399e5c7e6577da49320a", "versionType": "git"}, {"lessThan": "0967074f6830718fd2597404ef119bddd0dbfd00", "status": "affected", "version": "30b5f20bb2ddab013035399e5c7e6577da49320a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix FDP fdpcidx bounds check\n\nThe fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=,\nincorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1)."}], "id": "CVE-2026-74361", "lastModified": "2026-08-15T06:22:37.677", "metrics": {}, "published": "2026-08-15T06:22:37.677", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0967074f6830718fd2597404ef119bddd0dbfd00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d0e7d2af884b91329235abb16652ae4eead8079"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5e406928404d67a8da8aa3ae21732e1ea1a04118"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}