# CVE-2026-97433

Linux NVMe FDP parsing bug enables kernel memory corruption or crash

- Page: https://www.vulneraibility.com/cve/CVE-2026-97433
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.32% (percentile 25.1)
- Published: 2026-09-24

## Affected versions

- Linux: affected >= 30b5f20bb2ddab013035399e5c7e6577da49320a and < 97efd7a41aac08b43ea2337c5913a2bc75484f9f; >= 30b5f20bb2ddab013035399e5c7e6577da49320a and < 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8; 6.16; fixed in < 6.16, >= 6.18.53 and <= 6.18.*, >= 7.2 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Malformed NVMe FDP descriptors can cause unbounded iteration/reads leading to kernel crashes, info disclosure or local privilege escalation.

## Action

Patch when possible

## Recommendation

Apply vendor kernel updates and reboot affected hosts immediately

## References

- [other] https://git.kernel.org/stable/c/97efd7a41aac08b43ea2337c5913a2bc75484f9f
- [other] https://git.kernel.org/stable/c/0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.