In the Linux kernel, the following vulnerability has been resolved:
nvmet: Fix crash when a namespace is disabled
The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running blktests/nvme/058 (eg for loop transport):
[ 2352.930426] [ T53909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI [ 2352.930431] [ T53909] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 2352.930434] [ T53909] CPU: 3 UID: 0 PID: 53909 Comm: kworker/u16:5 Tainted: G W 6.13.0-rc6 #232 [ 2352.930438] [ T53909] Tainted: [W]=WARN [ 2352.930440] [ T53909] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 2352.930443] [ T53909] Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] [ 2352.930449] [ T53909] RIP: 0010:blkcg_set_ioprio+0x44/0x180
as the queue is already torn down when calling submit_bio();
So we need to init the percpu counter in nvmet_ns_enable(), and wait for it to drop to zero in nvmet_ns_disable() to avoid having I/O pending after the namespace has been disabled.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 12, 2025 |
| Suse | — | Upgrade kernel-azure-develUpgrade kernel-source-rtUpgrade kernel-macrosUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade kernel-docsUpgrade kernel-source-vanillaUpgrade kernel-sourceUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-extraUpgrade kernel-devel-azureUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-alteraUpgrade dtb-sprdUpgrade kernel-kvmsmallUpgrade gfs2-kmp-defaultUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade dtb-qcomUpgrade kernel-default-vdsoUpgrade kernel-rt-optionalUpgrade dtb-exynosUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade kernel-syms-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade dtb-armUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade kselftests-kmp-azureUpgrade kernel-rt-develUpgrade kernel-azure-extraUpgrade kernel-debugUpgrade kernel-devel-rtUpgrade kernel-default-livepatchUpgrade dlm-kmp-defaultUpgrade kernel-symsUpgrade kernel-develUpgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-default-optionalUpgrade dtb-freescaleUpgrade kernel-zfcpdumpUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade cluster-md-kmp-rtUpgrade dtb-amdUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade dtb-appleUpgrade dtb-apmUpgrade ocfs2-kmp-defaultUpgrade dtb-broadcomUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-64kbUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatch-develUpgrade dtb-xilinxUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade dtb-marvellUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-socionextUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade dtb-mediatekUpgrade dtb-lgUpgrade kernel-source-azure | Dec 5, 2025 | Jun 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub