Executive brief
The Linux kernel's NVMe-TCP driver manages storage network connections for fast NVMe storage devices. During error recovery when a connection fails, a NULL pointer dereference occurs if an administrator runs diagnostics (nvme list command), causing a kernel crash. This can disrupt storage access and require system restart.
Technical details
The vulnerability is a use-after-free / NULL pointer dereference in the nvme_tcp_get_address() function in drivers/nvme/host/tcp.c. During error recovery, the TCP socket is released and recreated; however, concurrent calls to nvme_tcp_get_address() (invoked by the 'nvme list' command) attempt to call kernel_getsockname() on the released socket without checking if it is still valid. The fix adds a mutex lock and a flag check (NVME_TCP_Q_LIVE) to ensure the socket is not accessed after it has been released. No user authentication is required; any local user can trigger this by running nvme list while error recovery is in progress. The impact is a kernel panic / denial of service.
Affected products
- Linux Linux Kernel Multiple versions (fix backported across 2.6.11 through 6.x and beyond)
Timeline
- 2025-10-07: disclosed: Published on NVD
- 2023-02-28: patched: Upstream fix commit 76d54bf20cdcc1ed7569a89885e09636e9a8d71d
- 2023-03-11: other: Backported to stable kernels via commit d82f762db4776fa11de88018f0f5de2d5db72a72