Summary
A device-controlled NVMe format index could select an entry beyond the number of sector formats allocated, causing a one-byte out-of-bounds write.
Technical analysis
The accompanying research article explains the finding, reproduction, and remediation status.
Read the technical write-upDisclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified