CVE-2026-97433

CVE-2026-97433

High · published September 24, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nvme: validate FDP configuration descriptor sizes

Validate descriptor sizes while walking the FDP configurations log so

dsze == 0 or a descriptor past the log end cannot cause unbounded

iteration or reads past the buffer.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.6th percentile
Published
2026-09-24T21:17Z
References (2)
https://git.kernel.org/stable/c/0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/97efd7a41aac08b43ea2337c5913a2bc75484f9f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 16:03Z
    nvme: validate FDP configuration descriptor sizes
    cvelistv5