Executive brief
The Linux kernel's Apple NVMe driver contains a memory synchronization bug in queue initialization that could allow interrupt handlers and request processing paths to observe uninitialized queue state. This could result in system crashes, data corruption, or undefined behavior on Apple SoC systems using NVMe storage.
Technical details
This is a memory ordering bug in the nvme-apple driver (drivers/nvme/host/apple.c). The apple_nvme_init_queue() function initializes queue state (memory zeroing of TCBs and completion queues) and then marks the queue as enabled using WRITE_ONCE(). A subsequent wmb() (write memory barrier) was insufficient to guarantee that interrupt handlers and request processing paths see the initialization before the enabled flag. The fix replaces the WRITE_ONCE() + wmb() pattern with smp_store_release() for queue enablement, and changes all queue-enabled checks from READ_ONCE() to smp_load_acquire(), ensuring proper acquire/release semantics. Without this synchronization, concurrent readers could observe enabled=true while initialization is still in-flight, causing reads of uninitialized memory. The vulnerability is a memory ordering issue, not directly exploitable over the network—it requires local system access and specific timing conditions to trigger.
Affected products
- Linux Linux Kernel multiple versions
Timeline
- 2026-09-17: disclosed
- 2026-06-18: patched