Critical · published July 16, 2024
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix possible use-after-free in transport error_recovery work
While nvme_tcp_submit_async_event_work is checking the ctrl and queue
state before preparing the AER command and scheduling io_work, in order
to fully prevent a race where this check is not reliable the error
recovery work must flush async_event_work before continuing to destroy
the admin queue after setting the ctrl state to RESETTING such that
there is no race .submit_async_event and the error recovery handler
itself changing the ctrl state.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 5.4.181 | 5.4.181 |
| linux/linux_kernel | ≥ 5.5, < 5.10.102 | 5.10.102 |
| linux/linux_kernel | ≥ 5.11, < 5.15.25 | 5.15.25 |
| linux/linux_kernel | ≥ 5.16, < 5.16.11 | 5.16.11 |