CVE-2026-46135

A flaw was found in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. A race condition exists between the handling of an Initialization Connection Request (ICReq) and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a double free vulnerability. This could lead to a denial of service (DoS) due to memory corruption.

This vulnerability is rated as Moderate impact on Red Hat Enterprise Linux because the affected NVMe over Fabrics TCP target service is neither loaded nor configured by default. Although network-adjacent or remote clients can trigger the flaw to cause a kernel crash or memory corruption by abruptly closing a handshake, exploitation is limited exclusively to hosts deliberately deployed as NVMe-oF TCP storage targets. Systems acting solely as NVMe initiators or general-purpose servers do not run this service and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.