Memory Management Flaw in Linux Kernel NVMe Implementation

CVE-2026-98056

What is CVE-2026-98056?

A significant vulnerability in the Linux kernel's NVMe implementation allows for excessive CPU cycles to be consumed during the scanning of namespaces. Specifically, when processing gaps in the reported Namespace Identifier (NSID) list, the nvme_scan_ns_list() function inefficiently iterates through each individual gap, potentially leading to soft lockups. This could cause performance bottlenecks in systems leveraging NVMe storage due to prolonged CPU engagement without resolving the underlying issue. To mitigate this, the function has been updated to remove gaps in a single pass based on an open NSID range, improving efficiency by targeting present namespaces only.

References