CVE-2026-74361 is an off-by-one bounds bypass in the NVMe FDP (Flexible Data Placement) subsystem, scored 9.8 CVSS. The bug is mechanically trivial — a '>' instead of '>=' — but the surrounding context reveals something more important than the typo itself: this is the latest instance of a pattern that has produced identical vulnerabilities across kernel subsystems for decades.
The variable naming in the vulnerable code explicitly encodes the correct boundary: n = NUMFDPC + 1. The developer understood the logic but selected the wrong operator. This is not merely a cognitive slip — it is evidence of a pattern that externalizes critical semantic decisions into human operator selection, where they are predictably error-prone. The n = BOUND + 1 idiom is a programming fossil from an era when C lacked saturated arithmetic or native exclusive-upper-bound types. It persists not because it is good design but because replacing it would require auditing every caller, and the pattern's structure satisfies reviewers' pattern-matching without demanding character-level inspection.
The CVSS 9.8 rating warrants scrutiny in context. This is NVMe FDP code — a specialized subsystem handling storage data placement and reclaim. Exploitation requires not just passing a malicious fdp_idx but integrating with the FDP reclaim mechanism and physical storage access patterns. The EPSS score of 0.00448 reflects market consensus that realistic exploitability is low. The CVSS captures potential severity correctly, but using it as a proxy for patching priority obscures the real question: this pattern is almost certainly still present elsewhere in the kernel, possibly in code paths that haven't been reviewed since the FDP implementation landed.
For defenders: patch this, but treat the patch as a single data point in a family of vulnerabilities, not an isolated incident. The remediation that prevents the next instance is commit-level — express bounds checks as range assertions (ASSERT(idx < NUMFDPC)) rather than inline comparisons, giving reviewers a distinct syntactic target. The institutional memory of this specific failure class has not translated into structural prevention despite decades of evidence. That is the vulnerability, not the typo.