Linux kernel (drivers/nvme/target): A client that asks the target to create a submission queue with an invalid queue ID

Impact

A client that asks the target to create a submission queue with an invalid queue ID leaks a controller reference on every attempt. The controller object and everything hanging off it (queues, buffers, AER state) is then never freed even after the client disconnects, so a peer can pin target memory indefinitely and eventually starve the shared storage node.

Who can reach it

Reachable by any peer that has established a connection to the nvmet subsystem and can issue an admin Create SQ command with an out-of-range sqid - a one-field change in a command the client fully controls. No target-side privilege and no tenant device node required. Conditional on nvmet being configured and exporting a subsystem the peer can reach.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: restrict which hosts may connect to the subsystem (host NQN allow-list rather than allow-any-host), and watch for controllers that never disappear after disconnect.

References