CVE-2026-98056
Received Received - Intake

NVMe namespace removal denial of service in Linux kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvme_scan_ns_list() drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvme_find_get_ns() to look the namespace up and removes it if it is present. The loop runs once per NSID in the gap rather than once per namespace actually present. NSIDs are 32-bit, so a target with a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove. watchdog: BUG: soft lockup - CPU#4 stuck for 26s! Workqueue: nvme-wq nvme_scan_work [nvme_core] RIP: 0010:__srcu_read_unlock+0xb/0x20 Call Trace: nvme_find_get_ns+0x7d/0xb0 [nvme_core] nvme_scan_ns_list+0xe8/0x280 [nvme_core] nvme_scan_work+0x18a/0x280 [nvme_core] process_one_work+0x197/0x380 worker_thread+0x2fe/0x410 kthread+0xe0/0x100 Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range() and give it an open (start, end) NSID range. ctrl->namespaces is sorted by NSID, so the whole gap is dropped in a single walk that stops once end is reached. This bounds the work by the namespaces that are present instead of by the size of the gap.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98056
EUVD
EUVD-2026-86709

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel nvme *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a performance issue in the NVMe (Non-Volatile Memory Express) subsystem. The function nvme_scan_ns_list() inefficiently removes stale namespaces by iterating once per NSID gap in the reported list, which can cause a soft lockup if the NSID space is sparse. This leads to excessive CPU usage and system unresponsiveness.

Detection Guidance

This vulnerability may cause system hangs or soft lockups due to excessive CPU usage during namespace scanning. Check system logs for soft lockup messages or CPU stalls. Monitor for high CPU usage in the nvme-wq workqueue. Use commands like 'dmesg | grep -i soft lockup' or 'journalctl -k | grep -i soft lockup' to detect issues.

Impact Analysis

This vulnerability can cause your system to become unresponsive or freeze due to a soft lockup, where the CPU gets stuck processing the excessive iterations. This may lead to degraded performance, application crashes, or system downtime, especially on systems with sparse NVMe namespace IDs.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. If immediate patching is not possible, consider disabling the affected NVMe namespace scanning functionality or limiting sparse NSID ranges on NVMe devices to reduce the risk of triggering the loop.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart