From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08490342507 for ; Mon, 8 Jun 2026 15:47:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780933645; cv=none; b=mlUlQcgR1DLixkXcmZGYBmDmR2hmoIqiv60xju8mC81p4kUO996+k8s4PmxSXClJcj5eF2z+k57p1SbzJpG0hK2C14okU8oTVj/eH8T5SXcwyAb/I7UN9OAmkZT9qjSHuidgZRgV+SKWLbn1+yvYPp+5BAKAbwFCAwTNy+xZ8+w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780933645; c=relaxed/simple; bh=BcGg1u64Sep78S/7iInqVfXyND+TrTTz38omqWHTKBw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZWUvmn57ootqPll8voGwTMxu7KW8YZq9q3IFeTPieVEV+f4t8JCOP+ODquEv9RnU7KVq+sw9/+oPBraVtfQDjDOKow0EhlOxg5IgcK/sokNWZJkN+q41v7MzdlMDXey0JYb047EZXccF5O2HCNw7+UoiPrUbY5xLS+5IYePOFWQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AOV9vBvj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AOV9vBvj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F22FC1F00893; Mon, 8 Jun 2026 15:47:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780933643; bh=tqU+dBllvARujzCPyIMwUnhG1nSFfaYoDMHmZPoFFQc=; h=From:To:Cc:Subject:Date:Reply-To; b=AOV9vBvje+foPR0SRX9Xv89We5avIs728ENj5263zKmloQjgm9t0X6gDmlQ92WpCU Suo4RemJL3R6lkt/Y5hfxl98MxkotlxhwmroTAoV5LTWjHE9K/sthbBqQP/KfiWdZx PEubfIbkvqhQ2DNinACNw1rE0q9bTWOH4DJM+ncU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Date: Mon, 8 Jun 2026 17:46:11 +0200 Message-ID: <2026060800-CVE-2026-46304-be50@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=8420; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ywjAPVVNUsi+ecBpww3pAjg6t+4MPRq0Q3KiHFhd58A=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlqj3dclGv3nPdIWfxiVtAhRcklnydlmkRMctEWqfCfG Vy411ysI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbC4cUwV/R3xxwJRqWLFlXW muyeC/hS3LmFGOaKuMxX+uAf7eX7r3bustX7vbbxGn8FAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain: nvmet_tcp_schedule_release_queue() kref_put(&queue->kref, nvmet_tcp_release_queue) nvmet_tcp_release_queue() queue_work(nvmet_wq, &queue->release_work) <--- nvmet_wq process_one_work() nvmet_tcp_release_queue_work() nvmet_cq_put(&queue->nvme_cq) nvmet_cq_destroy() nvmet_ctrl_put(cq->ctrl) nvmet_ctrl_free() flush_work(&ctrl->async_event_work) <--- nvmet_wq Previously Scheduled by :- nvmet_add_async_event queue_work(nvmet_wq, &ctrl->async_event_work); This trips lockdep with a possible recursive locking warning. [ 5223.015876] run blktests nvme/003 at 2026-04-07 20:53:55 [ 5223.061801] loop0: detected capacity change from 0 to 2097152 [ 5223.072206] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 [ 5223.088368] nvmet_tcp: enabling port 0 (127.0.0.1:4420) [ 5223.126086] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. [ 5223.128453] nvme nvme1: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349 [ 5233.199447] nvme nvme1: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" [ 5233.227718] ============================================ [ 5233.231283] WARNING: possible recursive locking detected [ 5233.234696] 7.0.0-rc3nvme+ #20 Tainted: G O N [ 5233.238434] -------------------------------------------- [ 5233.241852] kworker/u192:6/2413 is trying to acquire lock: [ 5233.245429] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 [ 5233.251438] but task is already holding lock: [ 5233.255254] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0 [ 5233.261125] other info that might help us debug this: [ 5233.265333] Possible unsafe locking scenario: [ 5233.269217] CPU0 [ 5233.270795] ---- [ 5233.272436] lock((wq_completion)nvmet-wq); [ 5233.275241] lock((wq_completion)nvmet-wq); [ 5233.278020] *** DEADLOCK *** [ 5233.281793] May be due to missing lock nesting notation [ 5233.286195] 3 locks held by kworker/u192:6/2413: [ 5233.289192] #0: ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0 [ 5233.294569] #1: ffffc9000e2a7e40 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x6e0 [ 5233.300128] #2: ffffffff82d7dc40 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 [ 5233.304290] stack backtrace: [ 5233.306520] CPU: 4 UID: 0 PID: 2413 Comm: kworker/u192:6 Tainted: G O N 7.0.0-rc3nvme+ #20 PREEMPT(full) [ 5233.306524] Tainted: [O]=OOT_MODULE, [N]=TEST [ 5233.306525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 5233.306527] Workqueue: nvmet-wq nvmet_tcp_release_queue_work [nvmet_tcp] [ 5233.306532] Call Trace: [ 5233.306534] [ 5233.306536] dump_stack_lvl+0x73/0xb0 [ 5233.306552] print_deadlock_bug+0x225/0x2f0 [ 5233.306556] __lock_acquire+0x13f0/0x2290 [ 5233.306563] lock_acquire+0xd0/0x300 [ 5233.306565] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306571] ? __flush_work+0x20b/0x530 [ 5233.306573] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306577] touch_wq_lockdep_map+0x3b/0x90 [ 5233.306580] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306583] ? __flush_work+0x20b/0x530 [ 5233.306585] __flush_work+0x268/0x530 [ 5233.306588] ? __pfx_wq_barrier_func+0x10/0x10 [ 5233.306594] ? xen_error_entry+0x30/0x60 [ 5233.306600] nvmet_ctrl_free+0x140/0x310 [nvmet] [ 5233.306617] nvmet_cq_put+0x74/0x90 [nvmet] [ 5233.306629] nvmet_tcp_release_queue_work+0x19f/0x360 [nvmet_tcp] [ 5233.306634] process_one_work+0x206/0x6e0 [ 5233.306640] worker_thread+0x184/0x320 [ 5233.306643] ? __pfx_worker_thread+0x10/0x10 [ 5233.306646] kthread+0xf1/0x130 [ 5233.306648] ? __pfx_kthread+0x10/0x10 [ 5233.306651] ret_from_fork+0x355/0x450 [ 5233.306653] ? __pfx_kthread+0x10/0x10 [ 5233.306656] ret_from_fork_asm+0x1a/0x30 [ 5233.306664] There is also no need to flush async_event_work from controller teardown. The admin queue teardown already fails outstanding AER requests before the final controller put :- nvmet_sq_destroy(admin sq) nvmet_async_events_failall(ctrl) The controller has already been removed from the subsystem list before nvmet_ctrl_free() quiesces outstanding work. Replace flush_work() with cancel_work_sync() so a pending async_event_work item is canceled and a running instance is waited on without recursing into the same workqueue. The Linux kernel CVE team has assigned CVE-2026-46304 to this issue. Affected and fixed versions =========================== Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 5.10.258 with commit ae5b0cad163833e10b271e9becc05d81dae56e5f Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 5.15.209 with commit 8d66ba89480ff098a58d79003a505f383aa4e920 Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 6.1.175 with commit a696fbbd5240b4ac9b166f7bd4c550882ff543f1 Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 6.6.140 with commit 9a4d7222c0955b221e38bb66d10e6bccb672c8a1 Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 6.12.88 with commit ee6e20c4bc9eae542a0954a368449532383169d4 Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 6.18.30 with commit 781f47d641432c26c19625b2cdd7f40825097592 Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 7.0.7 with commit 551f445a56a11a6457550cddcf39c9ebb8bcacc6 Issue introduced in 4.10 with commit 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 and fixed in 7.1-rc2 with commit aade8abd8b868b6ffa9697aadaea28ec7f65bee6 Issue introduced in 4.9.68 with commit 3976dd677e891c0b2c63d08028d445663539472c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-46304 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/target/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ae5b0cad163833e10b271e9becc05d81dae56e5f https://git.kernel.org/stable/c/8d66ba89480ff098a58d79003a505f383aa4e920 https://git.kernel.org/stable/c/a696fbbd5240b4ac9b166f7bd4c550882ff543f1 https://git.kernel.org/stable/c/9a4d7222c0955b221e38bb66d10e6bccb672c8a1 https://git.kernel.org/stable/c/ee6e20c4bc9eae542a0954a368449532383169d4 https://git.kernel.org/stable/c/781f47d641432c26c19625b2cdd7f40825097592 https://git.kernel.org/stable/c/551f445a56a11a6457550cddcf39c9ebb8bcacc6 https://git.kernel.org/stable/c/aade8abd8b868b6ffa9697aadaea28ec7f65bee6