Executive brief
A race condition exists in the Linux kernel's NVMe target subsystem between configuration changes and controller initialization. When an administrator modifies the maximum number of queues while a new controller is being created, the new controller may be allocated with insufficient memory for its queues, potentially causing system instability or data corruption.
Technical details
A race condition exists in nvmet_alloc_ctrl() and nvmet_subsys_attr_qid_max_store() where the max_qid attribute can be modified via configfs while a controller is being allocated. An attacker with configfs write access can change max_qid after queue memory is allocated but before the controller is added to the active list, causing the allocated memory to be undersized. When nvmet_install_queue() later executes, it accesses memory beyond the allocated bounds. The fix protects queue allocation and list insertion with a read semaphore that conflicts with the write semaphore used during max_qid modification, and caches max_qid in the controller structure to prevent further changes after allocation.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed