CVE-2026-46135: nvmet-tcp: fix race between ICReq handling and queue teardown

Synopsis

A race condition in the Linux kernel's NVMe-over-TCP target driver (nvmet-tcp) allows an unauthenticated remote attacker to trigger a double free of a kernel queue object by sending a connection request and immediately dropping the connection. The vulnerability is reachable over the network without any credentials or user interaction. Successful exploitation gives the attacker full read, write, and denial-of-service capability against the affected host, up to and including remote code execution. Patched-image rebuilds at the fix versions (6.12.88, 6.18.30, and the named commits) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NVMe-over-TCP target port over the network; any host with network access to the exposed service can trigger the race.

• AuthenticationNot required

  No credentials are needed; the vulnerability is triggered during the unauthenticated connection-initialization handshake.

• Victim interactionNot required

  No user or administrator action is required on the target system; sending a crafted TCP sequence is sufficient.

• Attack complexityDetail

  The exploit is reliable and condition-free at the protocol level; the race window exists by design in the normal connection teardown path and does not require specific memory layouts or timing luck beyond the inherent TCP interaction.

Blast Radius

• An attacker who wins the race triggers a double kref_put on a freed kernel queue object, which corrupts kernel memory and can be used to read arbitrary kernel memory including stored credentials, keys, and session data.
• The same memory corruption primitive allows writes to arbitrary kernel data structures, enabling privilege escalation or persistent modification of kernel state.
• The vulnerability can crash the host kernel outright, taking down all workloads and services running on that node.
• Any container or process sharing the kernel on the affected host is exposed to the full impact of the kernel memory corruption, not just NVMe-connected workloads.