Linux kernel (drivers/nvme/host): The multipath sibling list is walked without SRCU protection during path revalidation

Impact

The multipath sibling list is walked without SRCU protection during path revalidation while concurrent scan work frees namespaces out from under it, giving a use-after-free on the initiator. The reported panic came from a live NVMe/RDMA multipath setup - the node dies and takes every tenant on it.

Who can reach it

Initiator-side, driven by the remote target: namespace-change async event notifications are what schedule scan work, and the target decides when and how often to send them. A target that a tenant controls, or one an attacker has compromised, can spray namespace-change AENs and capacity changes to force the concurrent revalidate/remove race. Requires native NVMe multipath enabled (the default) with a fabric transport.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: only connect initiators to targets you operate, and treat a node emitting repeated capacity-change/rescan events as suspect - drain it.

References