{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49569", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-09T09:50:31.772Z", "datePublished": "2025-01-11T12:25:19.455Z", "dateUpdated": "2026-08-05T11:40:01.374Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:01.374Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: unquiesce admin_q before destroy it\n\nKernel will hang on destroy admin_q while we create ctrl failed, such\nas following calltrace:\n\nPID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: \"nvme\"\n #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15\n #1 [ff61d23de260fc08] schedule at ffffffff8323c014\n #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1\n #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a\n #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006\n #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce\n #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced\n #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b\n #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362\n #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25\n RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202\n RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574\n RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004\n RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90\n R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004\n R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500\n ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b\n\nThis due to we have quiesced admi_q before cancel requests, but forgot\nto unquiesce before destroy it, as a result we fail to drain the\npending requests, and hang on blk_mq_freeze_queue_wait() forever. Here\ntry to reuse nvme_rdma_teardown_admin_queue() to fix this issue and\nsimplify the code." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The error path that hangs is selected entirely by data the remote NVMe-oF target supplies over the fabric (ICDOFF and the keyed-SGL bit in Identify Controller, or refusal of I/O-queue connect), and RoCEv2/iWARP are routable IP transports, so a malicious or compromised target reachable over the network drives the bug. NVMe-oF host/target sessions are ordinary network protocol exchanges, matching the treatment of other nvme fabrics host-side flaws.\nAC:L - The target only has to advertise a non-zero icdoff or clear NVME_CTRL_SGLS_KSDBDS to deterministically force the host into the destroy_admin path, and any admin request left undispatched on the quiesced queue makes the freeze wait forever. The attacker can also re-drive controller creation repeatedly via discovery-log-change AENs, so no condition outside their control must happen to line up.\nPR:N - The attacker is the remote peer and needs no credentials on the victim host — NVMe-oF requires no mandatory authentication, and there is no capable() check anywhere on the nvmf_dev_write → nvme_rdma_setup_ctrl path. The host-side privileged action is performed by the system's own autoconnect tooling, not by the attacker.\nUI:N - On hosts configured for NVMe-oF, systemd/udev autoconnect creates controllers (new=true) automatically in response to discovery-log-change AENs from the target, so no human action is needed at exploitation time.\nS:U - The hang is confined to the kernel's own block/NVMe layer and the calling process; no security authority or isolation boundary is crossed.\nC:N - The defect is a missing unquiesce leading to an indefinite wait in blk_mq_freeze_queue_wait(); no freed or out-of-bounds memory is read and nothing is disclosed to the attacker.\nI:N - There is no memory corruption, no write primitive, and no unintended state modification — the queue simply never drains, so no data can be altered.\nA:H - The calling task blocks forever in TASK_UNINTERRUPTIBLE and is unkillable, holding nvmf_dev_mutex so every later /dev/nvme-fabrics operation on the system wedges too, pinning the module and preventing clean shutdown; the hung-task watchdog fires and panics the box when hung_task_panic is set." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/host/rdma.c" ], "versions": [ { "version": "958dc1d32c80566f58d18f05ef1f05bd32d172c1", "lessThan": "427036030f4d796533dcadba9b845896cb6c10a7", "status": "affected", "versionType": "git" }, { "version": "958dc1d32c80566f58d18f05ef1f05bd32d172c1", "lessThan": "05b436f3cf65c957eff86c5ea5ddfa2604b32c63", "status": "affected", "versionType": "git" }, { "version": "958dc1d32c80566f58d18f05ef1f05bd32d172c1", "lessThan": "5858b687559809f05393af745cbadf06dee61295", "status": "affected", "versionType": "git" }, { "version": "a9ea34d2717a8c8892d3c5677329de9485e325ac", "status": "affected", "versionType": "git" }, { "version": "7da81eaf8710130a9e63d7429627183be5a93787", "status": "affected", "versionType": "git" }, { "version": "caed0b3851a4f52afd1ef77a27b30410fe7b68c7", "status": "affected", "versionType": "git" }, { "version": "5.4.103", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "5.10.21", "lessThan": "5.11", "status": "affected", "versionType": "semver" }, { "version": "5.11.4", "lessThan": "5.12", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/host/rdma.c" ], "versions": [ { "version": "5.12", "status": "affected" }, { "version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.88", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/427036030f4d796533dcadba9b845896cb6c10a7" }, { "url": "https://git.kernel.org/stable/c/05b436f3cf65c957eff86c5ea5ddfa2604b32c63" }, { "url": "https://git.kernel.org/stable/c/5858b687559809f05393af745cbadf06dee61295" } ], "title": "nvme-rdma: unquiesce admin_q before destroy it", "x_generator": { "engine": "bippy-1.2.0" } } } }