Linux kernel (drivers/nvme/host): Same race as the RDMA variant but on NVMe/TCP, which is the far more common fabric in

CVSS 9.8CVE-2022-48789Kernel, userspace & hypervisorcurated

Impact

Same race as the RDMA variant but on NVMe/TCP, which is the far more common fabric in a mixed cluster - an async-event submission can reach an admin queue whose socket error recovery has already released, giving a use-after-free and a kernel panic on the compute node.

Who can reach it

Initiator-side, triggered whenever the TCP connection to the target drops while the host has an AER outstanding. The remote target controls both halves: it sends the async event notification and it can close or stall the connection. This is a live concern if the operator connects initiators to tenant-controlled or shared NVMe/TCP targets, or if a tenant can interfere with the storage path on the network. Requires nvme-tcp in use.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: pin NVMe/TCP storage traffic to a network tenants cannot reach or disrupt, and only connect initiators to targets you operate.

References

https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 https://nvd.nist.gov/vuln/detail/CVE-2022-48789

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.