CVE-2026-72131

A flaw was found in the Linux kernel's nvme-apple driver affecting Apple A11 devices. This vulnerability occurs when Non-Volatile Memory Express (NVMe) command tags are not unique across the administrative and input/output queues. An attacker could exploit this by sending specially crafted commands, leading to a firmware crash and resulting in a Denial of Service (DoS) for the affected system.

Red Hat has evaluated this vulnerability as having a Moderate severity impact because potential exploitation is limited to a local denial of service on specialized Apple A11 SoC hardware. Enterprise Linux environments do not run on this consumer mobile architecture, and the vulnerable driver code is not present in supported Red Hat kernels. Consequently, this flaw poses no operational risk to supported Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.