Executive brief
A vulnerability in the Linux kernel's NVMe driver could allow a local user to cause a system crash. The issue occurs when the system attempts to access memory associated with a storage controller that has already been shut down. This can lead to a 'use-after-free' condition, resulting in a kernel panic and loss of system availability.
Technical details
A use-after-free vulnerability exists in the Linux kernel NVMe driver (drivers/nvme/host/core.c). The root cause is that namespaces can maintain stale references to a controller's admin request_queue after the controller has been torn down. Specifically, the 'blk_put_queue' call was occurring before all controller references were released. An attacker with local access could trigger this by submitting user commands (e.g., via ioctl) that attempt to enter the queue (blk_queue_enter) after teardown, leading to a slab-use-after-free. The fix involves moving the 'blk_put_queue' call to the 'nvme_free_ctrl' function to ensure the queue remains valid until all references are gone.
Affected products
- Linux Linux Kernel 6.13.2-ga1582f1a031e and earlier
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2025-11-04: patched: Initial patch authored by Keith Busch
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0
- https://git.kernel.org/stable/c/4896491c497226022626c3acc46044fd182f943c
- https://git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6c
- https://git.kernel.org/stable/c/e7dac681790556c131854b97551337aa8042215b
- https://git.kernel.org/stable/c/e8061d02b49c5c901980f58d91e96580e9a14acf
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html