Linux kernel NVMe-oF TCP target (nvmet-tcp, data-digest mismatch handling): With data digests enabled, a digest

Impact

With data digests enabled, a digest mismatch on a non-final H2C_DATA PDU makes the error handler call nvmet_req_uninit() - dropping the submission-queue percpu reference - without marking the command completed. Queue teardown then walks the command list, still sees the command as needing data, and touches it again: use-after-free on the storage target that serves the cluster's datasets and checkpoints. The attacker only needs to be able to open an NVMe/TCP connection and send a bad digest, so this is unauthenticated remote memory corruption in the process that has every tenant's namespaces attached.

Who can reach it

Remote and unauthenticated. Any host that can reach the nvmet-tcp listener - and on most clusters the storage VLAN is reachable from compute nodes, which means from tenant containers with host networking or from a compromised co-tenant job.

What to do

Kernel update on the storage target nodes making the digest-error path mark the command completed. Interim controls that actually work: turn off data digests on the affected subsystems (removes the trigger), and restrict the nvmet listener to the storage network with an explicit host-NQN allow list rather than accepting any connecting initiator.

References