Linux kernel (drivers/nvme/target): A client connected to your NVMe-oF TCP target can drive a reference-count underflow

Impact

A client connected to your NVMe-oF TCP target can drive a reference-count underflow on a target-side request object, giving a use-after-free on the shared storage node and, past that, a permanently wedged workqueue. Once the workqueue is stuck the target stops serving every subsystem it exports, so one tenant's malformed traffic becomes a storage outage for everyone homed on that node.

Who can reach it

Reachable by any peer on the IP/storage fabric that can open a TCP connection to the nvmet-tcp listener - the trigger is a command that fails nvmet_req_init (an unsupported opcode is enough) followed by a deliberately wrong data digest, both fully under the sender's control and both landing before any meaningful authorization on the command. Requires the node to be running nvmet with a tcp port enabled and data digest negotiated; no tenant device node is needed, only network reach to the target port.

What to do

No fixed version is listed on this record beyond the 5.10.261 / 5.12 stable branches - boot a kernel carrying the linked stable commits. Interim: restrict the nvmet-tcp listener to a management/storage VLAN that tenant workloads cannot address, or stop exporting the nvmet subsystem until the node is patched.

References