Linux kernel (drivers/nvme/target): A connecting client that abandons the TCP connection at the right moment during

Impact

A connecting client that abandons the TCP connection at the right moment during queue setup makes the target call through a NULL socket callback pointer - the crash dump literally shows the instruction pointer at address 0. The storage node panics, taking down every tenant volume it was serving.

Who can reach it

Any peer on the fabric that can reach the nvmet-tcp listening port. No credentials, no NVMe authentication, no tenant device node required - the race is in connection setup itself, before the queue is ever associated with a controller. The attacker only has to open and tear down connections quickly enough that the socket is not in an established state when nvmet_tcp_set_queue_sock runs, which is trivially repeatable from a script. Conditional on the node running nvmet with a TCP port enabled.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: firewall the nvmet-tcp port so only the storage network can reach it, or disable the TCP port on the target until patched.

References