CVE-2026-98056

A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver, which can lead to a Denial of Service (DoS). When scanning for storage namespaces, the driver iterates through gaps between namespace identifiers individually instead of processing only registered devices. A malicious or misconfigured NVMe storage device with sparsely allocated identifiers can force the system into an extensive loop, causing a CPU soft lockup that leaves the system unresponsive.

A moderate-severity denial of service flaw was found in the Linux kernel's NVMe driver. When scanning a namespace list, nvme_scan_ns_list() removes stale namespaces by iterating over every namespace identifier (NSID) in a gap individually instead of walking only the namespaces that are actually present. Because NSIDs are 32-bit values, a malicious or misconfigured NVMe device, or an NVMe over Fabrics target under attacker control, can report a sparsely allocated NSID list that makes a single gap spin the nvme_scan_work workqueue billions of times over identifiers with no corresponding namespace. This excessive CPU consumption causes a kernel soft lockup that leaves the system unresponsive. Only availability is affected; there is no impact on confidentiality or integrity.

This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 ELS and later RHEL 8, 9, and 10 update streams, Red Hat In-Vehicle OS 2, and the RHEL CoreOS content shipped with OpenShift Container Platform 4.12 and later, as those streams contain the vulnerable namespace list scanning code. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. Fixes for the affected streams are currently deferred, so the residual risk remains for systems that attach or rescan NVMe storage controlled by an untrusted or misconfigured device or target; the practical exposure is limited because triggering the vulnerable scan path requires local administrative access to attach, configure, or rescan NVMe storage.

The upstream CVE record rates this issue as Important using a network attack vector (CVSS 3.1 score 7.5), while Red Hat rates it Moderate (CVSS 3.1 score 5.5, local vector, privileges required). Red Hat's assessment reflects that exploiting this flaw requires local administrative-level access to configure or rescan NVMe storage on the host rather than an unauthenticated remote path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.