CVE-2026-98056

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme: remove stale namespaces by NSID range during scan

nvme_scan_ns_list() drops the stale namespaces in each gap in the

reported NSID list one NSID at a time. Every iteration calls

nvme_find_get_ns() to look the namespace up and removes it if it is

present. The loop runs once per NSID in the gap rather than once per

namespace actually present.

NSIDs are 32-bit, so a target with a sparse NSID space can make a

single gap spin the loop billions of times with nothing to remove.

watchdog: BUG: soft lockup - CPU#4 stuck for 26s!

Workqueue: nvme-wq nvme_scan_work [nvme_core]

RIP: 0010:__srcu_read_unlock+0xb/0x20

Call Trace:

nvme_find_get_ns+0x7d/0xb0 [nvme_core]

nvme_scan_ns_list+0xe8/0x280 [nvme_core]

nvme_scan_work+0x18a/0x280 [nvme_core]

process_one_work+0x197/0x380

worker_thread+0x2fe/0x410

kthread+0xe0/0x100

Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range()

and give it a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References