CVE-2026-46135 (GCVE-0-2026-46135)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-08-05 12:29
VLAI
Title
nvmet-tcp: fix race between ICReq handling and queue teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock. If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue. The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference. Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started. Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < b7dd4d27aa70bd98bb10572310e913668baf6a65 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 6f96dea4819d122737b217ea16660d255abbf8c6 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 5f0b95ef68ab9afba75b20eebf436130f80c161a (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < dcfe4d1f7960e7d1c01642318f3aae1a604f8508 (git)
Affected: 872d26a391da92ed8f0c0f5cb5fef428067b7f30 , < 5293a8882c549fab4a878bc76b0b6c951f980a61 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7dd4d27aa70bd98bb10572310e913668baf6a65",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "6f96dea4819d122737b217ea16660d255abbf8c6",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "5f0b95ef68ab9afba75b20eebf436130f80c161a",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "dcfe4d1f7960e7d1c01642318f3aae1a604f8508",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "5293a8882c549fab4a878bc76b0b6c951f980a61",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix race between ICReq handling and queue teardown\n\nnvmet_tcp_handle_icreq() updates queue-\u003estate after sending an\nInitialization Connection Response (ICResp), but it does so without\nserializing against target-side queue teardown.\n\nIf an NVMe/TCP host sends an Initialization Connection Request\n(ICReq) and immediately closes the connection, target-side teardown\nmay start in softirq context before io_work drains the already\nbuffered ICReq. In that case, nvmet_tcp_schedule_release_queue()\nsets queue-\u003estate to NVMET_TCP_Q_DISCONNECTING and drops the queue\nreference under state_lock.\n\nIf io_work later processes that ICReq, nvmet_tcp_handle_icreq() can\nstill overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the\nDISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and\nallows a later socket state change to re-enter teardown and issue a\nsecond kref_put() on an already released queue.\n\nThe ICResp send failure path has the same problem. If teardown has\nalready moved the queue to DISCONNECTING, a send error can still\noverwrite the state with NVMET_TCP_Q_FAILED, again reopening the\nwindow for a second teardown path to drop the queue reference.\n\nFix this by serializing both post-send state transitions with\nstate_lock and bailing out if teardown has already started.\n\nUse -ESHUTDOWN as an internal sentinel for that bail-out path rather\nthan propagating it as a transport error like -ECONNRESET. Keep\nnvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before\nhonoring that sentinel so receive-side parsing stays quiesced until the\nexisting release path completes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NVMe-over-TCP target driver, which processes PDUs from remote network peers on a listening TCP port (default 4420); the race is triggered by sending an ICReq and closing the connection \u2014 purely remote network operations.\nAC:L - The attacker controls both sides of the race (sends the ICReq, then immediately closes the connection) and can open unlimited connections to reliably win the timing window between softirq teardown and io_work processing, so success does not depend on conditions beyond the attacker\u0027s control.\nPR:N - The ICReq is the first PDU of the NVMe/TCP connection handshake and is handled entirely pre-authentication; an unauthenticated remote attacker need only connect and send an ICReq, with no credentials required in the default non-TLS configuration.\nUI:N - The attacker initiates the connection and triggers the race entirely on their own; no action from any local user or victim is required.\nS:U - The corruption is confined to the kernel\u0027s own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The double kref_put produces a use-after-free of the queue object, and per kernel UAF guidance this gives the attacker control over freed object contents, enabling arbitrary kernel memory disclosure.\nI:H - The use-after-free / double-free enables heap spraying to reclaim the freed allocation, providing a write primitive and potential control-flow hijack, so integrity impact is high.\nA:H - The refcount underflow and resulting use-after-free reliably cause kernel oops/panic, taking down the target system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:58.184Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7dd4d27aa70bd98bb10572310e913668baf6a65"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f96dea4819d122737b217ea16660d255abbf8c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f0b95ef68ab9afba75b20eebf436130f80c161a"
        },
        {
          "url": "https://git.kernel.org/stable/c/49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcfe4d1f7960e7d1c01642318f3aae1a604f8508"
        },
        {
          "url": "https://git.kernel.org/stable/c/5293a8882c549fab4a878bc76b0b6c951f980a61"
        }
      ],
      "title": "nvmet-tcp: fix race between ICReq handling and queue teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46135",
    "datePublished": "2026-05-28T09:35:49.828Z",
    "dateReserved": "2026-05-13T15:03:33.099Z",
    "dateUpdated": "2026-08-05T12:29:58.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46135",
      "date": "2026-08-28",
      "epss": "0.00397",
      "percentile": "0.32656"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T01:47:55.000Z",
      "cve": "CVE-2026-46135",
      "id": "msrc_CVE-2026-46135",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvmet-tcp: fix race between ICReq handling and queue teardown",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46135.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46135\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:29.060\",\"lastModified\":\"2026-07-24T15:17:22.523\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet-tcp: fix race between ICReq handling and queue teardown\\n\\nnvmet_tcp_handle_icreq() updates queue-\u003estate after sending an\\nInitialization Connection Response (ICResp), but it does so without\\nserializing against target-side queue teardown.\\n\\nIf an NVMe/TCP host sends an Initialization Connection Request\\n(ICReq) and immediately closes the connection, target-side teardown\\nmay start in softirq context before io_work drains the already\\nbuffered ICReq. In that case, nvmet_tcp_schedule_release_queue()\\nsets queue-\u003estate to NVMET_TCP_Q_DISCONNECTING and drops the queue\\nreference under state_lock.\\n\\nIf io_work later processes that ICReq, nvmet_tcp_handle_icreq() can\\nstill overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the\\nDISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and\\nallows a later socket state change to re-enter teardown and issue a\\nsecond kref_put() on an already released queue.\\n\\nThe ICResp send failure path has the same problem. If teardown has\\nalready moved the queue to DISCONNECTING, a send error can still\\noverwrite the state with NVMET_TCP_Q_FAILED, again reopening the\\nwindow for a second teardown path to drop the queue reference.\\n\\nFix this by serializing both post-send state transitions with\\nstate_lock and bailing out if teardown has already started.\\n\\nUse -ESHUTDOWN as an internal sentinel for that bail-out path rather\\nthan propagating it as a transport error like -ECONNRESET. Keep\\nnvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before\\nhonoring that sentinel so receive-side parsing stays quiesced until the\\nexisting release path completes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/target/tcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"b7dd4d27aa70bd98bb10572310e913668baf6a65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"6f96dea4819d122737b217ea16660d255abbf8c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"5f0b95ef68ab9afba75b20eebf436130f80c161a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"dcfe4d1f7960e7d1c01642318f3aae1a604f8508\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\"lessThan\":\"5293a8882c549fab4a878bc76b0b6c951f980a61\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/target/tcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"EC5D2550-3AB1-40D2-8FF2-1D37F2BB3534\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5293a8882c549fab4a878bc76b0b6c951f980a61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5f0b95ef68ab9afba75b20eebf436130f80c161a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f96dea4819d122737b217ea16660d255abbf8c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7dd4d27aa70bd98bb10572310e913668baf6a65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dcfe4d1f7960e7d1c01642318f3aae1a604f8508\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T15:43:22+00:00",
      "cve": "CVE-2026-46135",
      "id": "CVE-2026-46135",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:fixed": "1980",
      "product_status:known_not_affected": "64",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvmet-tcp: fix race between ICReq handling and queue teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46135.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.