Executive brief
The Linux kernel's NVMe Apple driver fails to properly clean up the admin queue when a storage controller is removed, leaving kernel timers and work queues armed on freed memory. When a controller fails to initialize and is torn down, this leads to a kernel panic and system crash, affecting availability on affected Apple systems.
Technical details
The vulnerability is a resource cleanup failure (use-after-free / double-free class) in the nvme-apple driver. The admin queue is allocated with blk_mq_alloc_queue() but never destroyed; when nvme_free_ctrl() drops the last reference, blk_mq_exit_queue() and blk_sync_queue() do not run, leaving the hardware context on the queue and leaving the timeout timer and work items armed. This condition occurs specifically when a controller fails to come up and is immediately torn down. The fix involves unquiescing and destroying the admin queue before nvme_uninit_ctrl(), mirroring the approach used in the PCIe driver. Attack vector is local/adjacent (requires controller initialization failure scenario); no network or authentication required.
Affected products
- Linux Linux kernel 7.2.0-rc1 and later (at time of fix)
Timeline
- 2026-09-17: disclosed