Linux kernel NVMe-oF target: recursive workqueue flush on queue teardown can stall the nvmet workqueue

Impact

On a node acting as an NVMe-over-Fabrics target, tearing down an RDMA queue runs nvmet_rdma_release_queue_work() on nvmet-wq, which ends up flushing ctrl->async_event_work on the same workqueue - a reentrant flush that lockdep reports as recursive locking on (wq_completion)nvmet-wq. The record describes it as a workqueue reentrancy defect fixed by moving async event work to a dedicated nvmet-aen-wq; it does not claim memory corruption or privilege gain. The practical exposure is availability of the NVMe-oF target: a disconnecting initiator drives the teardown path, and stalled nvmet work means exported namespaces stop serving. That matters where NVMe-oF over RDMA is the dataset or checkpoint path for GPU nodes, because the storage target is shared across many tenants and jobs.

Who can reach it

Any host that can establish and then drop an NVMe-oF RDMA connection to the target - i.e. anyone on the storage fabric. No authentication is needed beyond whatever the NVMe-oF subsystem allows for connecting; the trigger is ordinary queue disconnect, not a crafted payload. Not reachable from a node that does not run the nvmet target modules.

What to do

Pick up a stable kernel containing the fix (five stable commits are linked in the record; no single fixed version is stated). On an NVMe-oF target this is a kernel update, so drain the exported namespaces or fail over to the peer target, then reboot the node. The nvmet and nvmet_rdma modules cannot be reloaded under live connections without the same interruption.

References

Related entries

• Linux kernel (drivers/iommu/amd): The AMD IOMMU busy-waits for command completion while holding its spinlock withCVE-2026-43253 · Linux kernel (drivers/iommu/amd)High
• Linux kernel (drivers/iommu/intel): The 128-bit VT-d context entry is zeroed with multiple writes while its Present bitCVE-2026-45944 · Linux kernel (drivers/iommu/intel)High
• Linux kernel SMC (early link-group access on CLC decline in smc_clc_wait_msg): A peer can send a CLC decline before theCVE-2026-46027 · Linux kernel SMC (early link-group access on CLC decline in smc_clc_wait_msg)High
• Netty: client TLS silently skips hostname verification when a plain X509TrustManager is suppliedCVE-2026-50010 · Netty (SimpleTrustManagerFactory / X509TrustManagerWrapper hostname verification)High
• Linux kernel libceph: short ciphertext causes out-of-bounds read of the ceph_x_encrypt_headerCVE-2026-52956 · Linux kernel libceph (__ceph_x_decrypt header parsing)High
• Linux kernel CephFS: folios skipped for writeback are never put, leaking page referencesCVE-2026-52960 · Linux kernel ceph (writeback folio batch reference handling)High