CVE-2026-46135 nvmet-tcp: fix race between ICReq handling and queue teardown
A race condition in the Linux kernel's NVMe/TCP target allows a double-free of queue references, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46135?
CVE-2026-46135 is a critical vulnerability in Linux kernel, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: fix race between ICReq handling and queue teardown
nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown.
If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock.
If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue.
The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference.
Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started.
Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes.
Weakness: CWE-362
Which versions are affected by CVE-2026-46135?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46135?
Apply the vendor's patch.
Is CVE-2026-46135 being exploited?
There is no known exploitation of CVE-2026-46135 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88923, BELL-CVE-2026-46135, DEBIAN-CVE-2026-46135, GHSA-pp4w-65w8-f5f3, ROOT-OS-DEBIAN-11-CVE-2026-46135, ROOT-OS-DEBIAN-12-CVE-2026-46135 and 3 more.