Linux kernel (drivers/nvme/target): A client that completes the TLS handshake against the NVMe-oF TCP target and then

Impact

A client that completes the TLS handshake against the NVMe-oF TCP target and then lets the socket fall out of the established state leaks the whole queue structure and its socket - the target never notices the failure and never cleans up. Repeating it exhausts memory and socket resources on the shared storage node.

Who can reach it

Reachable from any peer on the fabric that can complete a TLS handshake with the nvmet-tcp listener; the leak is in the handshake-completion callback, so it lands before the controller association is established. Conditional on nvmet-tcp being configured with TLS - a plain-text target is not affected by this path.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: restrict fabric reachability of the TLS-enabled nvmet-tcp port to the storage network, and watch for queue/socket counts that climb without a matching client population.

References