In the Linux kernel, the following vulnerability has been resolved:
nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails
Have nvmet_req_init() and req->execute() complete failed commands.
Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the "queue_response" callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEVICE. This results in a double completion as nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod() when nvmet_req_init() fails.
Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command "security receive" $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096
This triggers a double completion as nvmet_req_init() fails and nvmet_pci_epf_queue_response() is called, here iod->dma_dir is still in the default state of "DMA_NONE" as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called. Because nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also called in nvmet_pci_epf_exec_iod_work() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops.
This patch lets nvmet_req_init() and req->execute() complete all failed commands, and removes the double completion case in nvmet_pci_epf_exec_iod_work() therefore fixing the edge cases where double completions occurred.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade cluster-md-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-rt-extraUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade dtb-caviumUpgrade kernel-source-vanillaUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade dtb-appleUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-rt-livepatchUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-extraUpgrade dtb-alteraUpgrade dtb-sprdUpgrade dtb-amdUpgrade kernel-64kb-optionalUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatchUpgrade kselftests-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade kernel-64kbUpgrade dtb-apmUpgrade dtb-amazonUpgrade gfs2-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-develUpgrade kernel-rtUpgrade dtb-freescaleUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade dtb-marvellUpgrade dtb-amlogicUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-develUpgrade kernel-rt-vdsoUpgrade kernel-docs-htmlUpgrade gfs2-kmp-rtUpgrade kernel-sourceUpgrade dtb-exynosUpgrade dtb-socionextUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade dtb-broadcomUpgrade dtb-armUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall | Dec 5, 2025 | Nov 6, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub