CVE-2026-4652
Published: 26 March 2026
Summary
CVE-2026-4652 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Freebsd Freebsd. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4652 affects the NVMe/TCP target implementation in FreeBSD, where a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue using a bogus or stale CNTLID. This vulnerability stems from a NULL pointer dereference (CWE-476) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An attacker requires only network access to the exposed NVMe/TCP target to exploit this unauthenticated vulnerability, resulting in a Denial of Service condition via kernel panic on the affected machine.
Mitigation details are provided in the FreeBSD Security Advisory FreeBSD-SA-26:07.nvmf, available at https://security.freebsd.org/advisories/FreeBSD-SA-26:07.nvmf.asc.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16130
Vulnerability details
On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID. An attacker with network access to the NVMe/TCP target can…
more
trigger an unauthenticated Denial of Service condition on the affected machine.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated NULL dereference in exposed NVMe/TCP target directly enables Endpoint DoS via application/system exploitation (kernel panic).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the NULL pointer dereference in the NVMe/TCP target by applying vendor patches from FreeBSD-SA-26:07.nvmf to prevent kernel panic from bogus CNTLID.
Information input validation ensures the NVMe/TCP target checks the validity of CONNECT command CNTLID values, preventing null dereference crashes from invalid inputs.
Denial-of-service protection limits the impact of remote unauthenticated attacks exploiting the NVMe/TCP vulnerability to trigger kernel panic.