## Summary
The Linux kernel nvme driver contained an off-by-one bounds check bug in FDP parameter handling. The check used > instead of >=, which could incorrectly accept an out-of-range FDP index value (fdp_idx == NUMFDPC + 1).
## Technical Details
- Vulnerable logic is in drivers/nvme/host/core.c within nvme_query_fdp_granularity(struct nvme_ctrl *ctrl, ...).
- The code computes n = le16_to_cpu(h->numfdpc) + 1.
- The bounds check previously used if (fdp_idx > n); this incorrectly allowed fdp_idx to equal n (i.e., NUMFDPC + 1).
- The fix changes the condition to if (fdp_idx >= n).
- Patch references:
- Upstream commit 0967074f6830718fd2597404ef119bddd0dbfd00.
- Stable backports include commits 5d0e7d2af884b91329235abb16652ae4eead8079 and 5e406928404d67a8da8aa3ae21732e1ea1a04118.
## Affected
- Linux kernel nvme host driver code in drivers/nvme/host/core.c (FDP query/registration path).
- Specifically the FDP index bounds check in nvme_query_fdp_granularity.
## Impact
- Potential memory-safety and/or incorrect FDP stream registration behavior due to accepting an invalid FDP index value.
- NVD indicates high severity (CVSS 9.8) with network attack vector and no privileges required (PR:N, UI:N), implying the vulnerable path can be reached via NVMe interaction over the network.
## Mitigation
1. Apply the kernel fix that changes the FDP bounds check from fdp_idx > n to fdp_idx >= n in nvme_query_fdp_granularity (e.g., commit 0967074f6830718fd2597404ef119bddd0dbfd00).
2. For stable kernels, ensure the corresponding backport commits are included (5d0e7d2af884b91329235abb16652ae4eead8079 / 5e406928404d67a8da8aa3ae21732e1ea1a04118).
3. After patching, validate that out-of-range FDP indices trigger the warning path (dev_warn(... "FDP index:%d out of range:%d")) and do not proceed with FDP stream registration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H