CVE-2026-72131 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

nvme-apple: Prevent shared tags across queues on Apple A11

On Apple A11, tags of pending commands must be unique across the admin
and IO queues, else the firmware crashes with
"duplicate tag error for tag N", with N being the tag.

Apply the existing workaround for M1 of reserving two tags for the admin
queue to A11.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/59cef6abc924a84824b0c3f563a7fe74cd5fc7a4
https://git.kernel.org/stable/c/6fe0687245e8406bf26143bd45eb16441bbe5280
https://git.kernel.org/stable/c/b7d9aaedf024bb6c0bb6a205848861d888eb1afa

History

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag. Apply the existing workaround for M1 of reserving two tags for the admin queue to A11.
Title		nvme-apple: Prevent shared tags across queues on Apple A11
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/59cef6abc924a84824b0c3f563a7fe74cd5fc7a4 https://git.kernel.org/stable/c/6fe0687245e8406bf26143bd45eb16441bbe5280 https://git.kernel.org/stable/c/b7d9aaedf024bb6c0bb6a205848861d888eb1afa

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:53:07.349Z

Updated: 2026-08-15T05:53:07.349Z

Reserved: 2026-08-09T03:40:39.907Z

Link: CVE-2026-72131

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:30.557

Modified: 2026-08-15T06:21:30.557

Link: CVE-2026-72131

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72131", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.907Z", "datePublished": "2026-08-15T05:53:07.349Z", "dateUpdated": "2026-08-15T05:53:07.349Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T05:53:07.349Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-apple: Prevent shared tags across queues on Apple A11\n\nOn Apple A11, tags of pending commands must be unique across the admin\nand IO queues, else the firmware crashes with\n\"duplicate tag error for tag N\", with N being the tag.\n\nApply the existing workaround for M1 of reserving two tags for the admin\nqueue to A11."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/apple.c"], "versions": [{"version": "04d8ecf37b5e06d16228a4d37d8548c17cf70461", "lessThan": "59cef6abc924a84824b0c3f563a7fe74cd5fc7a4", "status": "affected", "versionType": "git"}, {"version": "04d8ecf37b5e06d16228a4d37d8548c17cf70461", "lessThan": "b7d9aaedf024bb6c0bb6a205848861d888eb1afa", "status": "affected", "versionType": "git"}, {"version": "04d8ecf37b5e06d16228a4d37d8548c17cf70461", "lessThan": "6fe0687245e8406bf26143bd45eb16441bbe5280", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/apple.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/59cef6abc924a84824b0c3f563a7fe74cd5fc7a4"}, {"url": "https://git.kernel.org/stable/c/b7d9aaedf024bb6c0bb6a205848861d888eb1afa"}, {"url": "https://git.kernel.org/stable/c/6fe0687245e8406bf26143bd45eb16441bbe5280"}], "title": "nvme-apple: Prevent shared tags across queues on Apple A11", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/apple.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "59cef6abc924a84824b0c3f563a7fe74cd5fc7a4", "status": "affected", "version": "04d8ecf37b5e06d16228a4d37d8548c17cf70461", "versionType": "git"}, {"lessThan": "b7d9aaedf024bb6c0bb6a205848861d888eb1afa", "status": "affected", "version": "04d8ecf37b5e06d16228a4d37d8548c17cf70461", "versionType": "git"}, {"lessThan": "6fe0687245e8406bf26143bd45eb16441bbe5280", "status": "affected", "version": "04d8ecf37b5e06d16228a4d37d8548c17cf70461", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/apple.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-apple: Prevent shared tags across queues on Apple A11\n\nOn Apple A11, tags of pending commands must be unique across the admin\nand IO queues, else the firmware crashes with\n\"duplicate tag error for tag N\", with N being the tag.\n\nApply the existing workaround for M1 of reserving two tags for the admin\nqueue to A11."}], "id": "CVE-2026-72131", "lastModified": "2026-08-15T06:21:30.557", "metrics": {}, "published": "2026-08-15T06:21:30.557", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59cef6abc924a84824b0c3f563a7fe74cd5fc7a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6fe0687245e8406bf26143bd45eb16441bbe5280"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7d9aaedf024bb6c0bb6a205848861d888eb1afa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}