Linux kernel (drivers/nvme/target): The target disables a namespace without waiting for in-flight I/O to drain, so a

CVSS 9.8CVE-2025-21850Kernel, userspace & hypervisorcurated

Impact

The target disables a namespace without waiting for in-flight I/O to drain, so a request can be submitted against an already torn-down queue and dereference freed state - a general protection fault that panics the storage node. Any routine namespace reconfiguration becomes a coin flip on crashing the box while clients are attached.

Who can reach it

The crash needs two halves: an operator or automation disabling/reconfiguring an exported namespace (configfs, host root), and a connected client with I/O in flight at that instant. The client side is fully controlled by whoever is attached to the subsystem, so a tenant peer that keeps a steady stream of I/O open holds the window open permanently and turns every namespace disable into a node panic. Requires nvmet configured and exporting namespaces.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: quiesce or disconnect clients before disabling a namespace, and treat namespace reconfiguration on unpatched target nodes as a maintenance operation rather than an online one.

References

https://git.kernel.org/stable/c/cc0607594f6813342b27c752c6fb6f6eb9980cb5 https://git.kernel.org/stable/c/4082326807072b71496501b6a0c55ffe8d5092a5 https://nvd.nist.gov/vuln/detail/CVE-2025-21850

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.