CVE-2026-98154

A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over RDMA (Remote Direct Memory Access) driver. This vulnerability can lead to a Denial of Service (DoS) due to improper error cleanup during request processing. When an input/output (I/O) communication error occurs while queuing a request, the driver completes the request but subsequently performs duplicate cleanup and memory unmapping operations. A local user capable of issuing storage commands during network path errors can trigger this condition, resulting in memory corruption and a system crash.

The nvme rdma queue_rq error path can complete a request through nvme_host_path_error and then continue with duplicate command cleanup and SQE DMA unmapping. Because request completion can make the request available for reuse, later access to rq or req may race with reuse and create a potential use-after-free, stale cleanup, or incorrect DMA unmap condition. A successful trigger can at least crash the kernel and disrupt NVMe storage. In a worst case, reuse of request state or DMA metadata may cause memory corruption with confidentiality and integrity impact. For the CVSS the PR:N reflects a malicious or fault inducing NVMe RDMA endpoint that does not need privileges on the affected host. AV:A is used because exploitation requires reachability through the adjacent RDMA or storage fabric rather than general Internet access. AC:H reflects the need to produce an EIO posting failure and hit the request reuse timing window.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.