The NVMe driver in the Linux kernel contains a bounds‑check bug for the fdp_idx field. The code sets the maximum valid index to NUMFDPC + 1 but uses a greater‑than comparison instead of greater‑than‑or‑equal, incorrectly allowing an index equal to the maximum to pass validation. When that out‑of‑bounds index is subsequently used to address an internal array, the driver can read or write outside the bounds, corrupting kernel memory and possibly causing a kernel crash or loss of service.

All Linux kernel releases that contain the default NVMe driver before the bug‑fix commits are affected. The CNA does not list specific version numbers, so every kernel version shipping the unpatched NVMe code is potentially vulnerable until the update is applied.

With a CVSS score of 9.8 and an EPSS score of <1%, the likelihood of active exploitation is low and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a local interaction with the NVMe driver to supply an out‑of‑bounds index. Successful exploitation would lead to kernel memory corruption and a denial of service but does not, as described, provide a path to privilege escalation.