PT-2026-28218 · Nvme/Tcp+1 · Nvme/Tcp+1

Nikolay Denev · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-4652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NVMe/TCP (affected versions not specified)

Description A remote client can cause a kernel panic on a system exposing an NVMe/TCP target by sending a CONNECT command to an I/O queue with an invalid or outdated CNTLID. An attacker with network access to the NVMe/TCP target can trigger an unauthenticated Denial of Service condition on the affected machine. The vulnerable component is the handling of the CONNECT command and the validation of the CNTLID parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2026-4652

Produtos afetados

Freebsd

Nvme/Tcp

Referências · 4

• https://safe-surf.ru/specialists/bulletins-nkcki/730251 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-4652 · Nota de Segurança
• https://freebsd.org/security/advisories/FreeBSD-SA-26:07.nvmf.asc · Nota
• https://security.freebsd.org/advisories/FreeBSD-SA-26:07.nvmf.asc · Aviso do Fabricante