PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46135 Linux CVE debrief

A race condition in the Linux kernel's NVMe/TCP target implementation (nvmet-tcp) can lead to use-after-free conditions during queue teardown. The vulnerability occurs when nvmet_tcp_handle_icreq() updates queue state after sending an Initialization Connection Response (ICResp) without proper serialization against target-side queue teardown. If a host sends an ICReq and immediately closes the connection, target-side teardown may begin before io_work processes the buffered ICReq. This allows nvmet_tcp_handle_icreq() to overwrite the queue state from NVMET_TCP_Q_DISCONNECTING back to NVMET_TCP_Q_LIVE, defeating the disconnect guard and enabling a second kref_put() on an already released queue. The ICResp send failure path has an identical issue where send errors can overwrite NVMET_TCP_Q_FAILED state. The fix serializes post-send state transitions with state_lock and uses -ESHUTDOWN as an internal sentinel to bail out if teardown has already started.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-04
Advisory published
2026-05-28
Advisory updated
2026-07-04

Who should care

Linux kernel administrators running NVMe/TCP target configurations; storage infrastructure teams; cloud providers offering NVMe-oF services; security teams monitoring kernel-level storage driver vulnerabilities

Technical summary

The nvmet-tcp driver in the Linux kernel contains a race condition between ICReq (Initialization Connection Request) handling and queue teardown. The nvmet_tcp_handle_icreq() function updates queue->state after sending ICResp without holding state_lock, allowing concurrent teardown to set NVMET_TCP_Q_DISCONNECTING and drop the queue reference. Subsequent ICReq processing can overwrite state back to NVMET_TCP_Q_LIVE, causing a second teardown path to issue kref_put() on freed memory. The ICResp send failure path similarly allows NVMET_TCP_Q_FAILED to overwrite DISCONNECTING state. The fix adds state_lock serialization around post-send state transitions and introduces -ESHUTDOWN as a bail-out sentinel when teardown is in progress.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable tree commits once available for your distribution
  • Monitor Linux distribution security advisories for backported fixes
  • Restrict NVMe/TCP target exposure to trusted networks until patched
  • Enable connection rate limiting on NVMe/TCP targets where possible
  • Review kernel logs for unexpected NVMe/TCP queue state transitions as potential indicators

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-28. Four kernel.org stable tree commits are referenced as source material. The issue affects the NVMe/TCP target subsystem in the Linux kernel. No CVSS score or severity has been assigned by NVD (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46135 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46135

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46135 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46135

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5293a8882c549fab4a878bc76b0b6c951f980a61

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dcfe4d1f7960e7d1c01642318f3aae1a604f8508

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.