CVE-2026-4652
Received Received - Intake
Kernel Panic via Invalid CNTLID in NVMe/TCP Causes DoS

Publication date: 2026-03-26

Last updated on: 2026-04-30

Assigner: FreeBSD

Description
On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID. An attacker with network access to the NVMe/TCP target can trigger an unauthenticated Denial of Service condition on the affected machine.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-26
Last Modified
2026-04-30
Generated
2026-06-16
AI Q&A
2026-03-26
EPSS Evaluated
2026-06-14
NVD
CVE-2026-4652
EUVD
EUVD-2026-16130
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 15.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-4652 is a remote denial of service vulnerability in the FreeBSD operating system's NVMe over Fabrics implementation, specifically in the nvmf kernel module.

The issue occurs when a remote client sends a CONNECT command for an I/O queue with an invalid or stale CNTLID (controller identifier) to a system exposing an NVMe/TCP target.

This causes a null pointer dereference in the kernel, which triggers a kernel panic and results in an unauthenticated denial of service condition on the affected machine.

Impact Analysis

An attacker with network access to the NVMe/TCP target can exploit this vulnerability to cause the affected FreeBSD system to crash unexpectedly.

This results in an unauthenticated Denial of Service (DoS), making the system unavailable until it is rebooted.

There is no workaround available, so the only mitigation is to upgrade the system to a patched version and reboot.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.

Mitigation Strategies

To mitigate CVE-2026-4652, you must upgrade your FreeBSD system to a version released after the fix dates and then reboot.

  • If your system was installed from base system packages (15.0-RELEASE on amd64 or arm64), run the following commands:
  • pkg upgrade -r FreeBSD-base
  • shutdown -r +10min "Rebooting for a security update"
  • If your system was installed from binary distribution sets, run:
  • freebsd-update fetch
  • freebsd-update install
  • shutdown -r +10min "Rebooting for a security update"
  • Alternatively, apply the source code patch by downloading it, verifying its PGP signature, applying the patch, recompiling the kernel, and rebooting.
Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart