CVE-2024-26769

What it actually does

Deadlock occurs in nvmet-fc shutdown path when attempting nested flush of nvmet_wq during association deletion, resolved by deferring put work to a separate work item.

Why it matters to the business

Linux systems using NVMe over Fibre Channel may experience kernel hangs or crashes during storage association teardown, leading to unplanned downtime and service disruption; low EPSS indicates limited active exploitation risk but affects kernel stability in affected versions.

How an attack unfolds

An attacker triggers the association deletion code path through crafted NVMe-FC commands or transport events that initiate shutdown, causing the nested workqueue flush to deadlock the system.

How to fix it

Update the Linux kernel to a version containing commit 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 or later stable releases that include the fix for nvmet-fc deadlock avoidance.

How to confirm the fix worked

Verify kernel source or package version includes commit 5e0bc09a52b6169ce90f7ac6e195791adb16cec4; test association delete operations under load to confirm no deadlock occurs.

Typical attack path

1. Establish NVMe-FC association to target
2. Trigger association deletion via transport or command sequence
3. Cause nested nvmet_wq flush during shutdown
4. Induce deadlock resulting in system unresponsiveness

How to detect it

Review kernel logs for deadlock warnings or stack traces involving nvmet_wq and nvmet-fc association deletion; inspect dmesg or syslog for workqueue flush recursion indicators post-association teardown events.

What your security team should do

• Prioritize kernel upgrade on all systems exposing NVMe-FC targets
• Monitor for kernel oops or hang reports related to nvmet during storage operations
• Apply updates before the next maintenance window given the published fix date