A race condition in the Linux kernel NVMe driver allows concurrent calls to nvme_query_fdp_info() to overwrite the FDP placement identifier array without proper synchronization. This weakness, identified as CWE-366, can corrupt driver state and cause improper FDP registration, potentially leading to data corruption or a kernel crash.

All Linux kernel releases containing the NVMe driver before the commit 56e1c6bbe4bb084d7ecf61698afdf70be23dd35f are affected. This includes the core Linux kernel source and any distribution that ships a kernel version with the older NVMe code, such as standard Linux distributions.

The CVSS score of 5.5 coupled with an EPSS score of < 1% indicates a medium severity with a low probability of exploitation. It is not listed in CISA KEV. The race condition requires coordinated access from at least two NVMe paths scanning the same namespace, implying that an attacker would need privileged kernel-level interaction or the ability to influence multiple paths, which limits the attack surface. Exploitation could cause a denial of service or corrupt data, but no public exploits are known.