The flaw resides in the Linux kernel’s NVMe driver. The function nvme_query_fdp_info, which is executed for each NVMe path, writes the FDP placement identifier array without protecting against concurrent access. When two paths scan the same namespace at the same time, they can race to populate head->nr_plids and head->plids, resulting in corrupted state or incorrect FDP registration. The flaw could lead to improper driver behavior or kernel panic, effectively compromising data integrity and availability of NVMe storage.

Affected systems are all Linux kernel releases that implement the NVMe driver before the fix commit, identified by the SHA 56e1c6bbe4bb084d7ecf61698afdf70be23dd35f. Any distribution that ships a kernel containing the older NVMe code is potentially impacted. The listed vendors are Linux:Linux, indicating the core kernel source and all derived distributions.

The CVSS score is not reported, and EPSS is not available. KEV does not list this vulnerability. Because the race condition requires privileged interaction with the NVMe driver and manipulation of multiple paths targeting the same namespace, the attack surface is relatively narrow. An attacker with kernel or device‑management privileges could trigger the race, potentially causing a denial of service or setting the stage for further exploitation. No known public exploits exist, but the moderate severity of race‑condition bugs warrants prompt action.