Executive brief
A vulnerability in the Linux kernel's NVMe-over-PCIe target driver can cause a system crash (kernel oops) or state corruption. This occurs when the system receives certain malformed or unsupported storage commands, leading to a 'double completion' error. An attacker could exploit this to disrupt storage services or potentially compromise the stability of the host system.
Technical details
A double completion vulnerability exists in the Linux kernel's NVMe PCI endpoint function (PCI-EPF) target driver (drivers/nvme/target/pci-epf.c). When nvmet_req_init() fails (e.g., due to an unsupported opcode like 'security receive'), it internally triggers a completion via nvmet_pci_epf_queue_response(). However, the calling function nvmet_pci_epf_exec_iod_work() also attempts to complete the same I/O descriptor (IOD) upon failure, leading to a double completion. This results in corruption of the PCI NVMe target state and a kernel oops. The fix ensures that failed commands are completed only once by adjusting the error handling logic in the work queue.
Affected products
- Linux Linux Kernel 6.14 to 6.16.1
Timeline
- 2025-08-22: disclosed
- 2025-08-22: advisory
- 2025-08-15: patched