In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin request_queue lifetime
The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:
BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel6.12-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade kernel-livepatch-6.12.63-84.121Upgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade kernel6.12-headersUpgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel6.12-toolsUpgrade kernel-livepatch-6.1.168-202.320Upgrade python3-perf-debuginfoUpgrade kernel6.12-develUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel6.12-tools-develUpgrade perf-debuginfoUpgrade kernel-headersUpgrade bpftool6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade bpftool6.12Upgrade python3-perf6.12Upgrade kernel6.12-libbpfUpgrade kernel6.12-modules-extraUpgrade python3-perfUpgrade kernel6.12-modules-extra-commonUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12Upgrade kernel-libbpf-debuginfoUpgrade kernel-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel6.12-libbpf-develUpgrade perf | Feb 20, 2026 | Dec 16, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | May 3, 2026 | May 3, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Feb 24, 2026 | Dec 16, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 16, 2025 |
| Ubuntu | — | Upgrade linux-image-lowlatency-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-110-lowlatency-64kUpgrade linux-image-6.8.0-1051-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1059-azureUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-6.17Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-oem-6.17Upgrade linux-image-realtime-6.17Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-6.8.0-1049-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-110-generic-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-kvmUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1052-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-gcp-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.17.0-1009-gcpUpgrade linux-image-6.8.1-1047-realtimeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04cUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.17.0-1009-gcp-64kUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1054-gcp-64kUpgrade linux-image-6.8.0-1022-nvidia-tegra-rtUpgrade linux-image-6.8.0-1051-ibmUpgrade linux-image-6.8.0-1052-raspiUpgrade linux-image-6.8.0-110-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-6.17.0-1009-aws-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-oracle-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.17.0-1010-raspiUpgrade linux-image-gke-64k-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-virtualUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.17.0-1009-awsUpgrade linux-image-aws-64k-6.17Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.17.0-1010-azureUpgrade linux-image-gcp-6.17Upgrade linux-image-aws-6.17Upgrade linux-image-6.17.0-1009-oracle-64kUpgrade linux-image-6.8.0-1054-gcp-fipsUpgrade linux-image-realtimeUpgrade linux-image-oracle-6.17Upgrade linux-image-aws-64kUpgrade linux-image-gkeUpgrade linux-image-awsUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-azureUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64kUpgrade linux-image-ibm-classicUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1052-aws-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-genericUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1054-gcpUpgrade linux-image-nvidia-tegraUpgrade linux-image-azure-6.17Upgrade linux-image-raspi-realtimeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1052-aws-64kUpgrade linux-image-6.8.0-2042-raspi-realtimeUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1054-azureUpgrade linux-image-6.8.0-1049-oracleUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1051-nvidia-lowlatencyUpgrade linux-image-6.8.0-1051-nvidia-64kUpgrade linux-image-6.17.0-1017-oemUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-generic-6.17Upgrade linux-image-raspi-6.17Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-virtual-6.17Upgrade linux-image-6.17.0-1009-oracleUpgrade linux-image-raspiUpgrade linux-image-gcp-fipsUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-gke-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1022-nvidia-tegraUpgrade linux-image-6.17.0-19-genericUpgrade linux-image-xilinxUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-24.04dUpgrade linux-image-oem-24.04bUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1050-gke-64kUpgrade linux-image-gkeopUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-110-genericUpgrade linux-image-6.17.0-19-generic-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1054-azure-fipsUpgrade linux-image-6.17.0-1008-realtimeUpgrade linux-image-6.8.0-110-lowlatencyUpgrade linux-image-fips-6.8Upgrade linux-image-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1051-nvidiaUpgrade linux-image-6.8.0-1037-gkeopUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1050-gke | Mar 17, 2026 | Dec 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub