CVE-2026-98154
Description
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over RDMA (Remote Direct Memory Access) driver. This vulnerability can lead to a Denial of Service (DoS) due to improper error cleanup during request processing. When an input/output (I/O) communication error occurs while queuing a request, the driver completes the request but subsequently performs duplicate cleanup and memory unmapping operations. A local user capable of issuing storage commands during network path errors can trigger this condition, resulting in memory corruption and a system crash.
Statement
The nvme rdma queue_rq error path can complete a request through nvme_host_path_error and then continue with duplicate command cleanup and SQE DMA unmapping. Because request completion can make the request available for reuse, later access to rq or req may race with reuse and create a potential use-after-free, stale cleanup, or incorrect DMA unmap condition. A successful trigger can at least crash the kernel and disrupt NVMe storage. In a worst case, reuse of request state or DMA metadata may cause memory corruption with confidentiality and integrity impact. For the CVSS the PR:N reflects a malicious or fault inducing NVMe RDMA endpoint that does not need privileges on the affected host. AV:A is used because exploitation requires reachability through the adjacent RDMA or storage fabric rather than general Internet access. AC:H reflects the need to produce an EIO posting failure and hit the request reuse timing window.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 7 |
| Attack Vector | Adjacent Network | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
