CVE-2026-4652

HIGH

FreeBSD >=15.0-RELEASE - Unauthenticated Denial of Service via NVMe/TCP CONNECT Command

Title source: llm
STIX 2.1

Description

On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID. An attacker with network access to the NVMe/TCP target can trigger an unauthenticated Denial of Service condition on the affected machine.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0037
EPSS Percentile 28.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (2)
freebsd/freebsd 15.0 (5 CPE variants)
FreeBSD/FreeBSD 15.0-RELEASE - p5
Published Mar 26, 2026
Tracked Since Mar 26, 2026