{"id":"CVE-2026-46135","revision":"583f631f4a0644ed9166671017ec677b","records":[{"revision":"583f631f4a0644ed9166671017ec677b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46135","aliases":[],"title":"nvmet-tcp: fix race between ICReq handling and queue teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix race between ICReq handling and queue teardown\n\nnvmet_tcp_handle_icreq() updates queue->state after sending an\nInitialization Connection Response (ICResp), but it does so without\nserializing against target-side queue teardown.\n\nIf an NVMe/TCP host sends an Initialization Connection Request\n(ICReq) and immediately closes the connection, target-side teardown\nmay start in softirq context before io_work drains the already\nbuffered ICReq. In that case, nvmet_tcp_schedule_release_queue()\nsets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue\nreference under state_lock.\n\nIf io_work later processes that ICReq, nvmet_tcp_handle_icreq() can\nstill overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the\nDISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and\nallows a later socket state change to re-enter teardown and issue a\nsecond kref_put() on an already released queue.\n\nThe ICResp send failure path has the same problem. If teardown has\nalready moved the queue to DISCONNECTING, a send error can still\noverwrite the state with NVMET_TCP_Q_FAILED, again reopening the\nwindow for a second teardown path to drop the queue reference.\n\nFix this by serializing both post-send state transitions with\nstate_lock and bailing out if teardown has already started.\n\nUse -ESHUTDOWN as an internal sentinel for that bail-out path rather\nthan propagating it as a transport error like -ECONNRESET. Keep\nnvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before\nhonoring that sentinel so receive-side parsing stays quiesced until the\nexisting release path completes.","state":0,"publishedAt":"2026-05-28T09:35:49.828+00:00","modifiedAt":"2026-10-19T19:36:51.823+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/target/tcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"b7dd4d27aa70bd98bb10572310e913668baf6a65\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"6f96dea4819d122737b217ea16660d255abbf8c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"5f0b95ef68ab9afba75b20eebf436130f80c161a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"dcfe4d1f7960e7d1c01642318f3aae1a604f8508\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"872d26a391da92ed8f0c0f5cb5fef428067b7f30\",\n                            \"lessThan\": \"5293a8882c549fab4a878bc76b0b6c951f980a61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/target/tcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.144\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.88\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.30\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.7\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/b7dd4d27aa70bd98bb10572310e913668baf6a65","https://git.kernel.org/stable/c/9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b","https://git.kernel.org/stable/c/6f96dea4819d122737b217ea16660d255abbf8c6","https://git.kernel.org/stable/c/5f0b95ef68ab9afba75b20eebf436130f80c161a","https://git.kernel.org/stable/c/49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3","https://git.kernel.org/stable/c/67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6","https://git.kernel.org/stable/c/dcfe4d1f7960e7d1c01642318f3aae1a604f8508","https://git.kernel.org/stable/c/5293a8882c549fab4a878bc76b0b6c951f980a61"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46135","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46135","identifiers":["CVE-2026-46135"]},"retained":false,"historicalAffected":[]}],"coverage":[]}