Linux Kernel CVE-2026-98056

Requires the Linux host to attach to an NVMe target (NVMe-over-Fabrics controller or a crafted local NVMe device) that is under attacker control or misbehaving and that reports a sparse 32-bit NSID namespace list with a large gap between valid NSIDs. The soft lockup occurs during nvme_scan_work / nvme_scan_ns_list() namespace scanning when it walks each NSID in the gap one at a time. Limiting factors: the host administrator must initiate the connection to the malicious target (typically CAP_SYS_ADMIN 'nvme connect' for fabrics, or physical attachment for a local device), so this is not a drive-by unauthenticated exploit; impact is availability only (no data exposure or code execution), and patched kernels bound the work to namespaces actually present.

The single strong signal is CVSS availability impact (A:H) - this is a pure denial-of-service (soft lockup, watchdog 'CPU stuck for 26s' in nvme_scan_work), with C:N/I:N confirming NO confidentiality or integrity impact. The 'Information Disclosure' tag directly contradicts the CVSS vector and the description and is mislabeled. The NVD vector claims AV:N/AC:L/PR:N (network, low complexity, unauthenticated) yielding 7.5, but the description shows the lockup is triggered when the host scans a target that reports a sparse 32-bit NSID list - which requires the host to connect to a malicious/misbehaving NVMe target (typically an NVMe-oF fabrics target the admin explicitly connects to, or a crafted local device). That precondition makes AC:L optimistic; realistic complexity is higher because it depends on a specifically crafted sparse-NSID target and a victim-initiated connection. No EPSS, no CISA KEV, and no public POC are present. Net: a high-CVSS number driven by A:H, but real-world priority is LOW - a targeted DoS requiring attacker control of a storage target, not a widespread remotely-weaponizable flaw. No public exploit identified at time of analysis.

An attacker who controls an NVMe-over-Fabrics target (or supplies a malicious NVMe device) advertises a namespace list with a huge sparse gap between valid NSIDs. When the Linux host connects and runs nvme_scan_work, nvme_scan_ns_list() iterates once per NSID across the ~4-billion-wide gap, pinning a CPU and triggering a soft lockup / denial of service. No public exploit code is known; exploitation requires the host to attach to the malicious target.