{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53169", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.005Z", "datePublished": "2024-12-27T13:49:14.925Z", "dateUpdated": "2026-08-05T11:44:17.663Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:17.663Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fabrics: fix kernel crash while shutting down controller\n\nThe nvme keep-alive operation, which executes at a periodic interval,\ncould potentially sneak in while shutting down a fabric controller.\nThis may lead to a race between the fabric controller admin queue\ndestroy code path (invoked while shutting down controller) and hw/hctx\nqueue dispatcher called from the nvme keep-alive async request queuing\noperation. This race could lead to the kernel crash shown below:\n\nCall Trace:\n autoremove_wake_function+0x0/0xbc (unreliable)\n __blk_mq_sched_dispatch_requests+0x114/0x24c\n blk_mq_sched_dispatch_requests+0x44/0x84\n blk_mq_run_hw_queue+0x140/0x220\n nvme_keep_alive_work+0xc8/0x19c [nvme_core]\n process_one_work+0x200/0x4e0\n worker_thread+0x340/0x504\n kthread+0x138/0x140\n start_kernel_thread+0x14/0x18\n\nWhile shutting down fabric controller, if nvme keep-alive request sneaks\nin then it would be flushed off. The nvme_keep_alive_end_io function is\nthen invoked to handle the end of the keep-alive operation which\ndecrements the admin->q_usage_counter and assuming this is the last/only\nrequest in the admin queue then the admin->q_usage_counter becomes zero.\nIf that happens then blk-mq destroy queue operation (blk_mq_destroy_\nqueue()) which could be potentially running simultaneously on another\ncpu (as this is the controller shutdown code path) would forward\nprogress and deletes the admin queue. So, now from this point onward\nwe are not supposed to access the admin queue resources. However the\nissue here's that the nvme keep-alive thread running hw/hctx queue\ndispatch operation hasn't yet finished its work and so it could still\npotentially access the admin queue resource while the admin queue had\nbeen already deleted and that causes the above crash.\n\nThe above kernel crash is regression caused due to changes implemented\nin commit a54a93d0e359 (\"nvme: move stopping keep-alive into\nnvme_uninit_ctrl()\"). Ideally we should stop keep-alive before destroyin\ng the admin queue and freeing the admin tagset so that it wouldn't sneak\nin during the shutdown operation. However we removed the keep alive stop\noperation from the beginning of the controller shutdown code path in commit\na54a93d0e359 (\"nvme: move stopping keep-alive into nvme_uninit_ctrl()\")\nand added it under nvme_uninit_ctrl() which executes very late in the\nshutdown code path after the admin queue is destroyed and its tagset is\nremoved. So this change created the possibility of keep-alive sneaking in\nand interfering with the shutdown operation and causing observed kernel\ncrash.\n\nTo fix the observed crash, we decided to move nvme_stop_keep_alive() from\nnvme_uninit_ctrl() to nvme_remove_admin_tag_set(). This change would ensure\nthat we don't forward progress and delete the admin queue until the keep-\nalive operation is finished (if it's in-flight) or cancelled and that would\nhelp contain the race condition explained above and hence avoid the crash.\n\nMoving nvme_stop_keep_alive() to nvme_remove_admin_tag_set() instead of\nadding nvme_stop_keep_alive() to the beginning of the controller shutdown\ncode path in nvme_stop_ctrl(), as was the case earlier before commit\na54a93d0e359 (\"nvme: move stopping keep-alive into nvme_uninit_ctrl()\"),\nwould help save one callsite of nvme_stop_keep_alive()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The affected code is the NVMe-over-Fabrics host driver (nvme-tcp/rdma), whose teardown path is driven by a remote NVMe-oF target across the network: a peer returning a DNR-marked status to the I/O-queue Connect forces `nvmf_should_reconnect()` to fail and `nvme_tcp_reconnect_or_remove()` to call `nvme_delete_ctrl()` immediately. The remote peer also dictates keep-alive completion timing, since it is the endpoint answering the keep-alive commands that gate `q_usage_counter`.\nAC:L - The attacker controls both sides of the race — the deletion trigger (DNR status on Connect, or dropping the connection to exhaust reconnects) and the keep-alive request/response timing — and can repeat connect/teardown cycles indefinitely until the window is hit. The race is also hit spontaneously during ordinary controller shutdown on real hardware, as the reporter observed, confirming no attacker-uncontrollable precondition.\nPR:N - A malicious, compromised, or spoofed NVMe-oF target holds no privileges on the victim host, and NVMe/TCP is routinely deployed without DH-HMAC-CHAP authentication, so no host credentials are required to drive the controller into the racy delete path. The alternative local trigger (`delete_controller` sysfs, `S_IWUSR`) would require root, but the unauthenticated remote-peer path is the higher-severity reachable scenario.\nUI:N - On an already-connected host — or one using nvme-stas/autoconnect discovery, which re-establishes fabrics controllers automatically — the keep-alive timer, error recovery, reconnect, and delete work all run from kernel workqueues with no human action. No victim must mount, open, or click anything.\nS:U - The use-after-free corrupts kernel heap objects (`blk_mq_hw_ctx`, `request_queue`, tag set pages) within the same kernel security authority as the vulnerable driver. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free: `__blk_mq_sched_dispatch_requests()` walks `hctx->queue`, `hctx->dispatch`, and elevator state on memory already freed by `blk_mq_exit_queue()`/`blk_put_queue()`. The freed hctx comes from a general kmalloc cache, so reclaiming it with attacker-groomed content turns the stale dereferences into a kernel memory read primitive.\nI:H - The stale hctx is used to make indirect calls through `e->type->ops.dispatch_request` and `hctx->queue->mq_ops->queue_rq`, so controlling the reallocated slab object yields function-pointer hijack and write primitives. Per standard treatment, a UAF enabling heap spraying into a dispatch path is a High integrity impact.\nA:H - The directly observed and reliably reproducible result is a kernel oops/panic in `blk_mq_run_hw_queue()` from `nvme_keep_alive_work()`, as shown in the commit's call trace. This takes down the storage stack and the machine, and the remote peer can retrigger it on every reconnect cycle." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/host/core.c" ], "versions": [ { "version": "a54a93d0e3599b05856971734e15418ac551a14c", "lessThan": "30794f4952decb2ec8efa42f704cac5304499a41", "status": "affected", "versionType": "git" }, { "version": "a54a93d0e3599b05856971734e15418ac551a14c", "lessThan": "5416b76a8156c1b8491f78f8a728f422104bb919", "status": "affected", "versionType": "git" }, { "version": "a54a93d0e3599b05856971734e15418ac551a14c", "lessThan": "e9869c85c81168a1275f909d5972a3fc435304be", "status": "affected", "versionType": "git" }, { "version": "4101af98ab573554c4225e328d506fec2a74bc54", "status": "affected", "versionType": "git" }, { "version": "6.10.7", "lessThan": "6.11", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/host/core.c" ], "versions": [ { "version": "6.11", "status": "affected" }, { "version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/30794f4952decb2ec8efa42f704cac5304499a41" }, { "url": "https://git.kernel.org/stable/c/5416b76a8156c1b8491f78f8a728f422104bb919" }, { "url": "https://git.kernel.org/stable/c/e9869c85c81168a1275f909d5972a3fc435304be" } ], "title": "nvme-fabrics: fix kernel crash while shutting down controller", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53169", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:09:13.038535Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:07.698Z" } } ] } }