CVE-2026-46135

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix race between ICReq handling and queue teardown

nvmet_tcp_handle_icreq() updates queue->state after sending an

Initialization Connection Response (ICResp), but it does so without

serializing against target-side queue teardown.

If an NVMe/TCP host sends an Initialization Connection Request

(ICReq) and immediately closes the connection, target-side teardown

may start in softirq context before io_work drains the already

buffered ICReq. In that case, nvmet_tcp_schedule_release_queue()

sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue

reference under state_lock.

If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can

still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the

DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and

allows a later socket state change to re-enter teardown and issue a

second kref_put() on an already released queue.

The ICResp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References