CVE-2026-98056: nvme: remove stale namespaces by NSID range during scan
In the Linux kernel, the following vulnerability has been resolved:
nvme: remove stale namespaces by NSID range during scan
nvmescannslist() drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns() to look the namespace up and removes it if it is present. The loop runs once per NSID in the gap rather than once per namespace actually present.
NSIDs are 32-bit, so a target with a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove.
watchdog: BUG: soft lockup - CPU#4 stuck for 26s! Workqueue: nvme-wq nvmescanwork [nvmecore] RIP: 0010:srcureadunlock+0xb/0x20 Call Trace: nvmefindgetns+0x7d/0xb0 [nvmecore] nvmescannslist+0xe8/0x280 [nvmecore] nvmescanwork+0x18a/0x280 [nvmecore] processonework+0x197/0x380 workerthread+0x2fe/0x410 kthread+0xe0/0x100
Rename nvmeremoveinvalidnamespaces() to nvmeremovensidrange() and give it an open (start, end) NSID range. ctrl->namespaces is sorted by NSID, so the whole gap is dropped in a single walk that stops once end is reached. This bounds the work by the namespaces that are present instead of by the size of the gap.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using NVMe controllers are exposed when an NVMe target reports a sparse namespace-ID space containing very large gaps between reported NSIDs. The problematic work occurs during namespace scanning.
What is required to trigger the excessive CPU work?
A target must report an NSID list with a gap large enough to cause the kernel to iterate over many absent 32-bit namespace IDs. The vulnerable scan processes each missing NSID in the gap individually, even when no namespace exists for it.
How can I tell whether this is affecting a system?
Affected systems may report watchdog soft-lockup messages while the NVMe scan workqueue is running. The call trace can include nvme_find_get_ns, nvme_scan_ns_list, and nvme_scan_work.