The Linux kernel contains a flaw where descriptor sizes for FDP configuration logs are not properly validated. If a descriptor size is zero or the descriptor extends beyond the log end, the kernel can perform an unbounded iteration or read past the buffer. This out‑of‑bounds read can expose sensitive kernel memory or other data to a local attacker who can influence NVMe descriptor inputs, potentially leading to privileged information leakage.

All Linux kernel builds that include the vulnerable FDP handling code are affected. No specific version ranges are listed, but the issue exists in any kernel that has not yet incorporated the newer commit snapshots linked in the references.

The CVSS score of 8.2 classifies this vulnerability as High. The EPSS score of < 1% indicates a very low probability of exploitation, and it is not currently listed in CISA's KEV catalog. An attacker would need local or privileged access to supply malformed NVMe descriptors or otherwise trigger the problematic code path. While the attack requires kernel execution capability, exploitation could lead to information disclosure with significant impact to confidentiality and system integrity.