Linux kernel (drivers/nvme/host): A discard (TRIM) request that is retried and fails again before a fresh payload is

Impact

A discard (TRIM) request that is retried and fails again before a fresh payload is attached frees the same special payload twice, corrupting the kernel heap on a node shared by many tenants. Double-free of a slab object is the classic starting point for privilege escalation, not just a crash.

Who can reach it

Driven by ordinary discard traffic from an unprivileged tenant - fstrim, a filesystem's online discard, or a thin-provisioned volume - so no device passthrough is needed. Turning it into a reliable double free requires the discard to fail and be retried, which is much easier to arrange when the namespace lives on a fabric target rather than a local SSD: the target decides which commands error. Say so plainly - on operator-run local NVMe this is opportunistic, on a tenant-influenced NVMe-oF target it is drivable.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: disable online discard on tenant filesystems (mount without discard, batch with scheduled fstrim on the host) to shrink the exposed path.

References