CVE-2026-31523

A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) PCI driver. A local user can trigger a race condition during a system reset by changing the polled queue count. This vulnerability allows a high-priority task to attempt to poll a queue before the system's queue maps are updated, leading to "double completions." This can result in system instability or a denial of service (DoS).

The NVMe PCI driver now ensures polling targets only queues still marked polled during reset races. Red Hat treats this as local NVMe integrity/availability under admin-driven queue reconfiguration. Update kernels; optional mitigation is preventing nvme/nvme_core load only where NVMe is unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nvme and nvme_core modules from being loaded. See https://access.redhat.com/solutions/41278 for instructions.