In the Linux kernel, the following vulnerability has been resolved:
nvme: add missing SRCU grace period in error path
nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs.
The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-rt-debug-develUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-docUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade python3-perfUpgrade perfUpgrade kernel-zfcpdump-modulesUpgrade kernel-headersUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-debug-core | Oct 11, 2026 | Oct 5, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Oct 6, 2026 | Sep 16, 2026 |
| Rocky_linux | — | Upgrade kernel-tools-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-debug-coreUpgrade perfUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-debug-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-debug | Oct 7, 2026 | Oct 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub