CVE-2026-90206

A flaw was found in the Linux kernel. A timing issue, known as a race condition, can occur within the Non-Volatile Memory Express over Fabrics (NVMe-oF) target (nvmet) component. This happens when a system administrator or process changes a queue identifier (QID) limit while the system is allocating resources for a new controller. This can lead to the system incorrectly managing memory, potentially causing memory corruption. Such corruption could result in a system crash (denial of service) or, in some cases, allow an attacker with local access to gain elevated privileges.

This vulnerability is rated as an Important severity flaw because successful exploitation of the out-of-bounds write can lead to local privilege escalation or complete system termination. The issue is confined to systems actively operating as NVMe over Fabrics target nodes, a service not enabled or loaded by default on Red Hat Enterprise Linux. Exploitation requires precise timing between concurrent administrative configuration changes and client connection establishment, limiting the attack surface in standard deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.