Linux nvme: sparse NSID gaps make namespace scan iterate billions of times, causing soft lockup

Impact

nvme_scan_ns_list() dropped stale namespaces one NSID at a time across each gap in the reported NSID list, so the loop ran once per NSID in the gap rather than once per namespace actually present. NSIDs are 32-bit, so a target advertising a sparse NSID space makes a single gap spin billions of iterations, producing a soft lockup in nvme_scan_work on the nvme workqueue. This matters most where the NVMe target is not fully trusted or not fully controlled - NVMe-over-Fabrics storage serving GPU nodes - because a target-side NSID layout stalls a CPU on the host and hangs namespace scanning. Impact is availability only; the fix bounds the walk by the namespaces present rather than by the size of the gap.

Who can reach it

A NVMe target (local or over fabrics) that reports a sparse NSID list to the host. No host-side authentication or local access is required, but the attacker must control or influence the target's namespace reporting.

What to do

Take the stable kernel update carrying the nvme_remove_nsid_range() rework (four stable commits referenced). Kernel update and reboot per host; there is no configuration-level mitigation other than not attaching untrusted NVMe targets.

References

Related entries

• Linux kernel libiscsi_tcp: a Data-In PDU naming a WRITE command's ITT overwrites the writer's own pagesCVE-2026-98479 · Linux kernel libiscsi_tcp (Data-In PDU direction check in iscsi_tcp_hdr_dissect)High
• Linux kernel nvmet: metadata SGL allocation failure frees the data SGL against an unassigned p2p deviceCVE-2026-98964 · Linux kernel nvmet (P2P device handling in nvmet_req_alloc_p2pmem_sgls error path)High
• Linux kernel ice: relaxed Tx doorbell write on arm64 trips a BUG_ON in dql_completed and panics the hostCVE-2026-98965 · Linux kernel ice driver (Tx doorbell MMIO ordering on arm64)High
• Linux kernel libiscsi: a malicious iSCSI target crashes the initiator with an unsolicited NOP-InCVE-2026-99152 · Linux kernel libiscsi (__iscsi_complete_pdu management-response task lookup)High
• OpenSSL: ChaCha20-Poly1305 accepts 16-byte nonces, silently ignoring leading bytesCVE-2019-1543 · OpenSSL (ChaCha20-Poly1305 variable nonce length)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High