Executive brief
The Linux kernel's NVMe target subsystem contains a use-after-free vulnerability in the PCI endpoint function (EPF) driver that handles I/O command execution. An attacker with the ability to send specially crafted NVMe commands could trigger a kernel memory corruption, potentially leading to system crash or arbitrary code execution on systems using this driver.
Technical details
This vulnerability is a use-after-free in nvmet_pci_epf_exec_iod_work(), a function that handles NVMe I/O command execution. The root cause is a race condition: after calling req->execute(), the function reads iod->data_len and iod->dma_dir to determine whether device-to-host data transfer is needed. However, for commands that do not require data transfer, nvmet_pci_epf_queue_response() can free the iod structure asynchronously on another CPU before these fields are accessed, resulting in a use-after-free read. The fix reorders the code to read these fields before calling req->execute(), eliminating the race window. Attack vector is local/adjacent (requires ability to send NVMe commands), and exploitation could cause denial of service or information disclosure.
Affected products
- Linux Linux Kernel affected versions not specified in advisory
Timeline
- 2026-09-04: disclosed