Linux kernel NVMe: use-after-free on the admin request_queue during controller teardown

Impact

Namespaces could keep stale references to a controller's admin request_queue after the controller was torn down, so an ioctl arriving during or after teardown dereferences freed memory (KASAN slab-use-after-free in blk_queue_enter). The practical outcome is a host crash or corruption on a storage hot-remove, controller reset or driver unload path; the CVSS vector claims confidentiality, integrity and availability impact from a local low-privileged position, but reaching it needs the NVMe passthrough ioctl path. On a GPU node this is an availability problem first: local NVMe holds model weights, datasets and container images, and a kernel oops takes the whole node and every tenant job on it down with no graceful drain.

Who can reach it

Local. Requires the ability to issue NVMe passthrough ioctls on a /dev/nvme* character device - on a normal fleet that is root or a user explicitly granted the device, not an ordinary tenant pod - racing a controller teardown or reset.

What to do

Pick up the fix from the stable kernel series (commits linked in the record) via your distribution's kernel update. There is no runtime mitigation other than avoiding NVMe passthrough ioctls around controller resets, so this is a kernel upgrade: drain the node and reboot it. Batch it with the next scheduled kernel maintenance rather than opening a window tonight - exposure is local and privileged.

References

Related entries

• Linux kernel io_uring zero-copy send: unchecked chained notification context on completionCVE-2025-68317 · Linux kernel io_uring (zero-copy send, chained notification contexts)High
• Linux kernel: integer overflow in asymmetric_key_generate_id can overflow a key-id bufferCVE-2025-68724 · Linux kernel crypto/asymmetric_keys (asymmetric_key_generate_id length arithmetic)High
• Linux kernel (virt/kvm): KVM blocked turning KVM_MEM_GUEST_MEMFD on for an existing memslot but not turning it off, andCVE-2025-68810 · Linux kernel (virt/kvm)High
• Linux kernel on POWER hash MMU: stale hardware SLB entries cause an SLB multi-hit machine checkCVE-2025-71078 · Linux kernel powerpc/64s SLB preload cache (hash MMU)High
• Linux kernel (drivers/iommu): In an SVA context the IOMMU walks and caches the CPU's page tables, and on x86 everyCVE-2025-71089 · Linux kernel (drivers/iommu)High
• Linux kernel (drivers/gpu/drm/xe): The observation-config ioctl dereferences the config object after releasing the lockCVE-2025-71099 · Linux kernel (drivers/gpu/drm/xe)High