Linux kernel (drivers/nvme/target): The target disables a namespace without waiting for in-flight I/O to drain, so a

Impact

The target disables a namespace without waiting for in-flight I/O to drain, so a request can be submitted against an already torn-down queue and dereference freed state - a general protection fault that panics the storage node. Any routine namespace reconfiguration becomes a coin flip on crashing the box while clients are attached.

Who can reach it

The crash needs two halves: an operator or automation disabling/reconfiguring an exported namespace (configfs, host root), and a connected client with I/O in flight at that instant. The client side is fully controlled by whoever is attached to the subsystem, so a tenant peer that keeps a steady stream of I/O open holds the window open permanently and turns every namespace disable into a node panic. Requires nvmet configured and exporting namespaces.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: quiesce or disconnect clients before disabling a namespace, and treat namespace reconfiguration on unpatched target nodes as a maintenance operation rather than an online one.

References