CVE-2026-90206: nvmet: fix max_qid race between configfs and controller allocation

CVE-2026-90206: nvmet: fix max_qid race between configfs and controller allocation

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix max_qid race between configfs and controller allocation

The function nvmet_subsys_attr_qid_max_store() can race against
nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.

Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:
ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);
and at this exact point, a userspace process changes max_qid to 128,
nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It
attempts to delete active controllers to force a reconnect, but the
new controller won't be deleted because it hasn't been added to the
subsys->ctrls list yet.

nvmet_alloc_ctrl() then proceeds and adds the new controller to the
subsys->ctrls list. Later, when nvmet_install_queue() is called, it
will see max_qid set to 128, but the memory allocated for sqs is only
sized for 64 entries. This results in a KASAN out-of-bounds warning
and potential memory corruptions.

Fix this by protecting the queue allocations and list insertion in
nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because
nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem)
to modify the attribute, this safely prevents the configfs writer from
modifying max_qid during controller creation.

Copy the max_qid from the subsystem to the controller's structure
during the allocation; ctrl->max_qid never changes as long as the
controller remains in LIVE state, so this will prevent similar race
conditions.

The Linux kernel CVE team has assigned CVE-2026-90206 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit 3e980f5995e0bb4d86fef873a9c9ad66721580d0 and fixed in 7.2.6 with commit 2c23fc91789dfd9db746edb3ae9b90d65fabd410
	Issue introduced in 6.1 with commit 3e980f5995e0bb4d86fef873a9c9ad66721580d0 and fixed in 7.3-rc1 with commit f1a8846e06388113dfdbb89dee005083fa9afdf9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90206
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nvme/target/admin-cmd.c
	drivers/nvme/target/core.c
	drivers/nvme/target/fabrics-cmd.c
	drivers/nvme/target/nvmet.h
	drivers/nvme/target/pci-epf.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410
	https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9