nvme FDPDescriptor OOB

Vulnerability analysis

When the NVMe host driver queries FDP configuration from a controller, it walks a list of configuration descriptors by advancing a pointer using each descriptor's self-declared size field. The original code advances the pointer and only checks whether the new position has reached the buffer boundary afterward, and it never validates that the size is non-zero. A descriptor with a zero size causes the parser to spin in place without making progress, while a descriptor whose size extends beyond the buffer end allows kernel heap memory to be read out of bounds when subsequent descriptor fields are accessed. The fix validates that each descriptor size is non-zero and that the entire descriptor fits within the buffer before advancing the pointer, bailing out with a warning on any malformed entry. This code path is reached automatically when the kernel initializes FDP on an NVMe controller — a malicious PCIe NVMe device supplied by an attacker, or a malicious or man-in-the-middle NVMe-over-Fabrics target returning a crafted log page, can trigger it. No host-side privileges are required; the attack surface is the NVMe controller itself.