Linux Kernel CVE-2026-31557

Requires target system running Linux kernel nvmet-rdma module (CONFIG_NVME_TARGET_RDMA=y/m) with active NVMe-over-Fabrics RDMA target configured and accepting client connections. Attacker must have network reachability to RDMA-capable ports (typically InfiniBand or RoCE networks) where nvmet-rdma listens. Exploitation limited to environments using RDMA transport-does not affect nvmet-tcp, nvmet-fc, or nvmet-loop transports. Triggering requires initiating disconnect on an established NVMe-oF RDMA connection while async events are pending, achievable via normal NVMe disconnect commands (nvme disconnect). No authentication bypass required as NVMe-oF targets accept connections based on network access controls and NQN (NVMe Qualified Name) subsystem configuration. Vulnerability does not affect systems without nvmet kernel modules loaded or those using only NVMe initiator (client) functionality.

Real-world risk is LOW despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) suggests remote unauthenticated network exploitation with low complexity, but this is misleading-the vulnerability requires an active NVMe-over-Fabrics target deployment with RDMA transport, which is specialized storage infrastructure, not general-purpose servers. The EPSS score of 0.02% (5th percentile) confirms negligible observed exploitation activity. No CISA KEV listing indicates no active exploitation. The impact is purely availability (denial of service via deadlock), with no confidentiality or integrity compromise. Attack complexity is low only IF the target environment exists; automatable exploitation is possible but limited to triggering disconnect events on nvmet-rdma targets. The lockdep warning indicates this is primarily a reliability issue affecting production NVMe storage targets during normal disconnect operations rather than a critical security vulnerability. Prioritize patching for production NVMe-oF RDMA storage infrastructure; deprioritize for systems not running nvmet kernel modules.

An attacker with network access to an NVMe-over-Fabrics RDMA target initiates repeated connection and disconnection sequences to the nvmet-rdma service. By timing disconnect requests to coincide with pending async event notifications, the attacker triggers the nvmet_rdma_cm_handler disconnect path while async_event_work is queued. This causes nvmet_ctrl_free() to flush work on nvmet-wq while already executing on that queue, creating a recursive lock deadlock detected by lockdep. The target's nvmet-wq worker thread hangs indefinitely, preventing processing of subsequent storage I/O operations and effectively denying service to legitimate NVMe-oF clients. No exploit code publicly identified, but exploitation requires only standard NVMe-oF client tools to trigger disconnect events.