PT-2026-44258 · Linux · Linux Kernel

Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-46135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the nvmet-tcp module between the handling of Initialization Connection Requests (ICReq) and queue teardown. The function nvmet tcp handle icreq() updates the queue->state after sending an Initialization Connection Response (ICResp) without proper serialization against target-side queue teardown. If a host sends an ICReq and immediately closes the connection, the teardown process may set queue->state to NVMET TCP Q DISCONNECTING. Subsequently, if the buffered ICReq is processed, nvmet tcp handle icreq() may overwrite the state back to NVMET TCP Q LIVE. This bypasses the state guard in nvmet tcp schedule release queue(), potentially allowing a second teardown process to issue a second kref put() on a queue that has already been released. A similar issue occurs in the ICResp send failure path, where the state could be overwritten with NVMET TCP Q FAILED.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-46135

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46135 · Security Note
• https://git.kernel.org/stable/c/67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6 · Note
• https://git.kernel.org/stable/c/5293a8882c549fab4a878bc76b0b6c951f980a61 · Note
• https://twitter.com/windowsforum/status/2060289094299664892 · Twitter Post
• https://git.kernel.org/stable/c/49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3 · Note
• https://git.kernel.org/stable/c/dcfe4d1f7960e7d1c01642318f3aae1a604f8508 · Note