Linux nvme-rdma: admin queue left quiesced on setup failure, hanging the task that destroys it

Impact

When nvme_rdma_setup_ctrl() fails, the admin queue is quiesced to cancel requests but never unquiesced before destruction, so blk_mq_freeze_queue_wait() never completes and the thread doing the connect hangs in D state forever. For an operator this is an unkillable task plus an NVMe-oF target that will not attach - on nodes that mount model or dataset storage over NVMe/RDMA, a target that flaps during connect can wedge the storage path and the stuck freeze typically survives any retry, so the node has to be rebooted. Availability only: no memory disclosure or privilege gain, and it needs a failing controller setup to reach.

Who can reach it

Local user able to write to /dev/nvme-fabrics (normally root or a storage automation agent), or an adjacent NVMe-oF target on the fabric that fails controller creation. CVSS records it as adjacent-network with low privileges.

What to do

Update to a stable kernel that reuses nvme_rdma_teardown_admin_queue() on the failure path and reboot the node. The nvme_rdma module can be reloaded instead if no NVMe-oF namespaces are in use, but a node with a hung freeze will not unload it - plan a drain and reboot. Only kernel.org commits are given as fixes.

References

Related entries

• Intel TDX: insufficient verification of data authenticity in the ring 0 interface leaks trust-domain dataCVE-2025-31356 · Intel TDX (hypervisor-facing ring 0 interface)Medium
• Caliptra Core ROM: TOCTOU in update-reset lets compromised MCU firmware bypass secure boot silentlyCVE-2026-11835 · Caliptra Core ROM (UpdateResetFlow staging-address validation)Medium
• Dell OpenManage Enterprise: path traversal exposes files to a low-privileged adjacent userCVE-2026-91910 · Dell OpenManage Enterprise (path traversal, file read)Medium
• Intel processors (indirect branch prediction): Spectre v2: an attacker trains the indirect branch predictor so that aCVE-2017-5715 · Intel processors (indirect branch prediction)Medium
• Intel processors (bounds check bypass): Spectre v1: speculative execution past a bounds check lets an attacker readCVE-2017-5753 · Intel processors (bounds check bypass)Medium
• Intel processors (rogue data cache load): Meltdown: unprivileged code reads kernel memory - and on affected partsCVE-2017-5754 · Intel processors (rogue data cache load)Medium