Linux kernel (drivers/nvme/host): Same race as the RDMA variant but on NVMe/TCP, which is the far more common fabric in

Impact

Same race as the RDMA variant but on NVMe/TCP, which is the far more common fabric in a mixed cluster - an async-event submission can reach an admin queue whose socket error recovery has already released, giving a use-after-free and a kernel panic on the compute node.

Who can reach it

Initiator-side, triggered whenever the TCP connection to the target drops while the host has an AER outstanding. The remote target controls both halves: it sends the async event notification and it can close or stall the connection. This is a live concern if the operator connects initiators to tenant-controlled or shared NVMe/TCP targets, or if a tenant can interfere with the storage path on the network. Requires nvme-tcp in use.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: pin NVMe/TCP storage traffic to a network tenants cannot reach or disrupt, and only connect initiators to targets you operate.

References