Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion race

Impact

Ordinary client I/O to an nvmet block-device namespace can hit a completion race where the target's inline bio is torn down while the same bio is being re-submitted, dereferencing a NULL cgroup pointer in the block layer. The shared storage node crashes on the normal read/write path, so a single tenant's I/O pattern can knock out the target for all of them.

Who can reach it

Driven by a connected NVMe-oF client's regular I/O against an exported namespace backed by a block device - no special opcode and no privilege on the target side. Any tenant or peer that has been allowed to connect to the subsystem can push the target into the window; it is a timing race, so it favours high-rate I/O rather than a crafted packet. Requires nvmet configured with a bdev-backed namespace.

What to do

Update to 6.12.69 / 6.16 or later. Interim: no clean workaround short of stopping the nvmet subsystem export or moving affected namespaces to a patched node - the path is the normal I/O path, so it cannot be gated by configuration.

References