Linux kernel (drivers/nvme/host): A discard (TRIM) request that is retried and fails again before a fresh payload is

CVSS 9.8CVE-2024-41073Kernel, userspace & hypervisorcurated

Impact

A discard (TRIM) request that is retried and fails again before a fresh payload is attached frees the same special payload twice, corrupting the kernel heap on a node shared by many tenants. Double-free of a slab object is the classic starting point for privilege escalation, not just a crash.

Who can reach it

Driven by ordinary discard traffic from an unprivileged tenant - fstrim, a filesystem's online discard, or a thin-provisioned volume - so no device passthrough is needed. Turning it into a reliable double free requires the discard to fail and be retried, which is much easier to arrange when the namespace lives on a fabric target rather than a local SSD: the target decides which commands error. Say so plainly - on operator-run local NVMe this is opportunistic, on a tenant-influenced NVMe-oF target it is drivable.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: disable online discard on tenant filesystems (mount without discard, batch with scheduled fstrim on the host) to shrink the exposed path.

References

https://git.kernel.org/stable/c/882574942a9be8b9d70d13462ddacc80c4b385ba https://git.kernel.org/stable/c/c5942a14f795de957ae9d66027aac8ff4fe70057 https://nvd.nist.gov/vuln/detail/CVE-2024-41073

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.