Linux kernel (drivers/nvme/target): Every connection that dies partway through queue allocation on the NVMe-oF TCP

Impact

Every connection that dies partway through queue allocation on the NVMe-oF TCP target leaks a page-fragment cache reference that is never reclaimed. An unauthenticated peer that loops connect-then-drop drives unbounded kernel memory growth on the storage node until it OOMs, which is a full outage for every tenant using that target.

Who can reach it

Any peer with network reach to the nvmet-tcp listening port. The leak happens in nvmet_tcp_alloc_queue's error path, before the connection is authenticated or associated with a subsystem, so no credentials and no tenant device node are needed - just repeated half-open connections. Requires the node to be running nvmet with a TCP port enabled.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: restrict who can reach the nvmet-tcp port (storage VLAN only), rate-limit new connections to it at the firewall, and monitor slab growth on target nodes.

References