CVE-2026-31557

A flaw was found in the Linux kernel, specifically within the NVMe over Fabrics (NVMe-oF) target's nvmet and nvmet_rdma modules. A local attacker could potentially trigger a recursive locking condition in the nvmet-wq workqueue during asynchronous event processing. This issue arises when nvmet_ctrl_free() attempts to flush an asynchronous event work while already executing on the same workqueue, leading to a deadlock. The most important consequence is a Denial of Service (DoS), causing system instability or unresponsiveness.

NVMe-oF target async events were moved off the shared workqueue to avoid a lock recursion (nvmet_rdma vs nvmet work). Red Hat advises NVMe target operators to patch; exposure is limited to configurations exporting namespaces over fabrics.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nvmet module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.