Concurrent Access Vulnerability in Linux Kernel NVMe Driver

CVE-2026-98153

What is CVE-2026-98153?

A vulnerability has been identified in the NVMe driver of the Linux kernel, which allows for concurrent access to the FDP placement ID array. The function nvme_query_fdp_info() is called per-path, leading to potential race conditions when multiple paths attempt to access the same namespace simultaneously. This race condition can compromise data integrity as two paths may simultaneously modify the head->nr_plids and head->plids during FDP registration. The issue has been addressed by moving the initialization of these fields to the nvme_alloc_ns_head() function, ensuring that the operations are safely executed without contention.

References