Linux kernel NVMe target core (nvmet, request completion during IO connect): KASAN-confirmed use-after-free reached

Impact

KASAN-confirmed use-after-free reached through nvmet_execute_io_connect - the I/O queue connect command. The request is completed and freed by the transport's queue_response callback, and nvmet_req_complete() then dereferences it. Connect is the command every initiator sends first, so the freed object is manipulated on the path that establishes a tenant's connection to shared namespaces. The kernel CNA scores it network, unauthenticated, full CIA.

Who can reach it

Remote and unauthenticated - the I/O connect path is exercised before any in-band authentication completes.

What to do

Kernel update on target nodes. Restrict which initiators can reach the target and enforce host-NQN allow lists; neither closes the pre-auth window, but both shrink who can enter it.

References