SECUFOCUSNOW
Home›CVE index›CVE-2026-46135
Review reviewCritical

CVE-2026-46135

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TC...

CVSS
9.8
EPSS
0.40%
32.5% percentile
CISA KEV
Not listed
Published
2026.05.28
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.40%
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TC...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < b7dd4d27aa70bd98bb10572310e913668baf6a65, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 6f96dea4819d122737b217ea16660d255abbf8c6, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 5f0b95ef68ab9afba75b20eebf436130f80c161a, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < dcfe4d1f7960e7d1c01642318f3aae1a604f8508, >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 5293a8882c549fab4a878bc76b0b6c951f980a61, >= 5.0, >= 5.0 < 6.12.88, >= 6.13 < 6.18.30, >= 6.19 < 7.0.7, 7.1
Fixed versions
6.12.88, 6.18.30, 7.0.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-362