Executive brief
A flaw was found in the Linux kernel's NVMe Target (nvmet) component. Under specific conditions during the disconnection or teardown of an NVMe-over-TCP controller, the system may experience a deadlock. This could lead to a kernel hang or system instability, impacting the availability of storage services.
Technical details
A deadlock vulnerability exists in the Linux kernel's nvmet component due to recursive workqueue flushing. Specifically, nvmet_tcp_release_queue_work() runs on the nvmet-wq workqueue and can trigger nvmet_ctrl_free(). The teardown path in nvmet_ctrl_free() then attempts to flush ctrl->async_event_work on the same nvmet-wq, leading to a recursive locking scenario and potential deadlock. This issue is primarily reachable during NVMe-over-TCP controller release operations. The fix replaces flush_work() with cancel_work_sync() to avoid recursing into the same workqueue.
Affected products
- Linux Linux Kernel 7.0.0-rc3
Timeline
- 2026-04-08: patched: Fix committed to kernel tree
- 2026-06-08: advisory: CVE published
References
- https://git.kernel.org/stable/c/551f445a56a11a6457550cddcf39c9ebb8bcacc6
- https://git.kernel.org/stable/c/781f47d641432c26c19625b2cdd7f40825097592
- https://git.kernel.org/stable/c/8d66ba89480ff098a58d79003a505f383aa4e920
- https://git.kernel.org/stable/c/9a4d7222c0955b221e38bb66d10e6bccb672c8a1
- https://git.kernel.org/stable/c/a696fbbd5240b4ac9b166f7bd4c550882ff543f1
- https://git.kernel.org/stable/c/aade8abd8b868b6ffa9697aadaea28ec7f65bee6
- https://git.kernel.org/stable/c/ae5b0cad163833e10b271e9becc05d81dae56e5f