CVE-2026-98056: Linux Kernel NVMe DOS Vulnerability

CVE-2026-98056 Overview

CVE-2026-98056 is a denial-of-service vulnerability in the Linux kernel's NVMe (Non-Volatile Memory Express) driver. The flaw resides in nvme_scan_ns_list(), which removes stale namespaces by iterating one Namespace Identifier (NSID) at a time across each gap in the reported NSID list. Because NSIDs are 32-bit, a target advertising a sparse NSID space can force the loop to execute billions of iterations with no work to perform. This causes CPU soft lockups on the nvme-wq workqueue thread running nvme_scan_work. The condition degrades or stalls storage subsystem operations on affected hosts.

Critical Impact
A malicious or malformed NVMe target with a sparse 32-bit NSID layout can trigger CPU soft lockups during namespace scanning, resulting in denial of service on the Linux host.

Affected Products

Linux kernel NVMe core driver (nvme_core)
Linux stable kernel branches prior to the fixing commits
Systems using NVMe over Fabrics (NVMe-oF) or NVMe PCIe with untrusted or sparse NSID targets

Discovery Timeline

2026-09-25 - CVE-2026-98056 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98056

Vulnerability Analysis

The Linux NVMe driver scans controllers to enumerate attached namespaces using nvme_scan_ns_list(). When the controller reports a list of present NSIDs, the driver must prune namespaces that previously existed but are no longer reported. The pre-patch logic iterates every integer NSID in each gap between reported identifiers and calls nvme_find_get_ns() for each one.

NSIDs occupy a 32-bit space, so a gap can span billions of values. Each iteration performs an SRCU (Sleepable Read-Copy-Update) read-side lookup even when no namespace exists at that NSID. On a sparse namespace layout, the scan worker monopolizes a CPU long enough to trip the kernel soft lockup watchdog, as shown in the reported stack trace terminating in __srcu_read_unlock and nvme_find_get_ns.

Root Cause

The root cause is an algorithmic complexity flaw. The removal loop's cost scales with the size of the NSID gap rather than with the number of namespaces actually present on the controller. The driver treats a sparse identifier space as if it were dense, producing O(gap_size) work for O(0) results.

Attack Vector

An attacker controlling or impersonating an NVMe target, including an NVMe-oF endpoint reachable over the network, can advertise a sparse NSID list with large gaps between valid identifiers. When the host triggers a scan, the kernel worker enters the degenerate loop and stalls the CPU. The CVSS vector indicates network reachability, no privileges, and an availability-only impact.

No verified public exploit code is available. See the upstream fix commits referenced below for implementation details.

Detection Methods for CVE-2026-98056

Indicators of Compromise

Kernel log entries containing watchdog: BUG: soft lockup - CPU#N stuck for Ns! with a call trace through nvme_scan_work and nvme_find_get_ns.
Repeated or long-running nvme-wq worker threads consuming full CPU time on a single core.
NVMe controller rescan events coinciding with host unresponsiveness or I/O stalls.

Detection Strategies

Monitor dmesg and /var/log/messages for soft lockup backtraces originating in the nvme_core module.
Alert on CPU utilization anomalies on kernel workqueue threads, particularly kworker processes bound to nvme-wq.
Correlate NVMe-oF connection events from untrusted or newly discovered targets with subsequent scan work latency.

Monitoring Recommendations

Centralize kernel log collection and apply detection rules for soft lockup events paired with nvme_scan symbols.
Track NVMe discovery and reconnect events on hosts exposed to NVMe over TCP or RDMA fabrics.
Baseline normal scan completion time and alert on scans exceeding expected duration.

How to Mitigate CVE-2026-98056

Immediate Actions Required

Apply the stable kernel update containing the fix that renames nvme_remove_invalid_namespaces() to nvme_remove_nsid_range() and processes gaps using the sorted ctrl->namespaces list.
Restrict NVMe-oF target connectivity to trusted endpoints only, using network segmentation and authenticated transports.
Inventory hosts running vulnerable kernel versions and prioritize those exposed to NVMe over TCP or RDMA.

Patch Information

The fix bounds the removal work by the number of namespaces actually present rather than by the size of the NSID gap. The patch walks the sorted ctrl->namespaces list once and stops when the gap's end NSID is reached. Fix commits are available in the upstream stable tree: commit 4ed7f3d7, commit 52200fc4, commit c84ad740, and commit f56b2bb4.

Workarounds

Avoid connecting hosts to untrusted NVMe-oF discovery controllers until patches are deployed.
Where feasible, unload the nvme_core module on systems that do not require NVMe connectivity to untrusted targets.
Use firewall rules to restrict NVMe over TCP ports (default 4420/tcp) to known target IP addresses.

bash

# Verify running kernel version and NVMe module state
uname -r
lsmod | grep nvme

# Restrict NVMe over TCP to known targets (example using nftables)
nft add rule inet filter input tcp dport 4420 ip saddr != 10.0.0.0/24 drop