Linux kernel NVMe target core (controller teardown racing queue-pair establishment): An initiator that disconnects

Impact

An initiator that disconnects while its admin CONNECT is still in flight opens a window where nvmet_sq_destroy() runs concurrently with controller allocation, leaking the controller and its pending async event requests. A remote party controls both halves - connect, then abandon - so the leak is repeatable on demand until the target exhausts memory. Connect-and-drop is also indistinguishable from an unstable client, so it is quiet.

Who can reach it

Remote, unauthenticated. Repeated connect/abort cycles against the target.

What to do

Kernel update fixing the ordering in nvmet_sq_destroy(). Watch target memory and connection-churn metrics as a detection proxy; allow-list initiators to limit who can churn.

References