UBUNTU-CVE-2026-98056: High severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist() drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns() to look the namespace up and removes it if it is present. The loop runs once per NSID in the gap rather than once per namespace actually present. NSIDs are 32-bit, so a target with a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove. watchdog: BUG: soft lockup - CPU#4 stuck for 26s! Workqueue: nvme-wq nvmescanwork [nvmecore] RIP: 0010:srcureadunlock+0xb/0x20 Call Trace: nvmefindgetns+0x7d/0xb0 [nvmecore] nvmescannslist+0xe8/0x280 [nvmecore] nvmescanwork+0x18a/0x280 [nvmecore] processonework+0x197/0x380 workerthread+0x2fe/0x410 kthread+0xe0/0x100 Rename nvmeremoveinvalidnamespaces() to nvmeremovensidrange() and give it an open (start, end) NSID range. ctrl->namespaces is sorted by NSID, so the whole gap is dropped in a single walk that stops once end is reached. This bounds the work by the namespaces that are present instead of by the size of the gap.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update nvme_scan_ns_list() to remove stale namespaces by NSID range: rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range(), pass an open (start, end) NSID range, and walk the sorted ctrl->namespaces once until end is reached instead of iterating once per NSID.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the listed Ubuntu kernel packages are exposed when they scan an NVMe controller whose reported namespace identifiers contain very large sparse gaps. The affected scan work runs in the nvme-wq workqueue.
What must occur for the denial of service condition to be triggered?
The NVMe namespace scan must process a reported NSID list with a gap large enough to cause repeated lookups for namespace IDs that are not present. Because NSIDs are 32-bit, a sparse namespace layout can cause billions of iterations for one gap.
How can an administrator recognize possible exploitation or impact?
A system may log a watchdog soft-lockup warning while the nvme-wq workqueue is running nvme_scan_work. The reported stack trace includes nvme_find_get_ns, nvme_scan_ns_list, and nvme_scan_work.