CVE-2026-98153: nvme: fix racy access to FDP placement id array

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-21
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it. Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.

Affected products

Linux kernel: from 6.16 before 7.2.7; 7.3-rc1 — fixed in 7.2.7

How to fix

Upgrade to a fixed version: Linux kernel 7.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98153 or the next vulnerability affects your stack