Executive brief
The Linux kernel's NVMe driver has a memory safety bug in its error handling path when allocating NVMe namespaces. During error recovery, the driver removes a namespace from a shared list without waiting for background readers to finish accessing it, allowing them to reference already-freed memory. This can lead to kernel crashes or privilege escalation on systems using NVMe storage devices.
Technical details
The vulnerability is a use-after-free in the NVMe namespace allocation error path (nvme_alloc_ns() at out_unlink_ns). The code removes a namespace structure from a linked list using list_del_rcu() but fails to call synchronize_srcu() to wait for in-progress SRCU (Sleepable RCU) readers before freeing the namespace. Multipath code in nvme_find_path() and nvme_mpath_revalidate_paths() iterates the namespace list under srcu_read_lock(), so a concurrent reader can still hold a reference to the namespace when kfree() executes. The normal removal path (nvme_ns_remove()) correctly synchronizes with a grace period; the error path was missing this protection. The fix adds a synchronize_srcu() call in the error handler. No authentication or user interaction is required; the vulnerability is triggered during NVMe namespace enumeration failures on any affected kernel version.
Affected products
- Linux Linux kernel affected versions include at least Linux 4.x through 6.x and later (exact lower bound not specified in advisory, but fix appears in linux-4.0.y through linux-7.2.y stable branches)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-11: patched: Committed to stable branches by Greg Kroah-Hartman
- 2026-08-15: other: Patch authored by Tristan Madani