CVE-2024-27435

What it actually does

Race condition in NVMe over RDMA admin queue tag allocation creates an ABBA deadlock: a keep-alive request holds the sole reserved tag while the queue is quiesced during controller reset, preventing the connect command from acquiring a tag on fabric_q which shares the tagset, causing permanent reconnection failure.

Why it matters to the business

Linux systems relying on NVMe over RDMA storage may suffer irreversible loss of connectivity after a controller reset even when the target and network remain available, resulting in extended application downtime and potential data unavailability on affected kernels.

How an attack unfolds

An attacker or environmental condition triggers a controller reset while a keep-alive command holds the reserved tag inside the quiesced admin queue; subsequent reconnect attempts on the shared tagset fail indefinitely because no reserved tag is available for the connect command.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit 149afee5c7418ec5db9d7387b9c9a5c1eb7ea2a8 or later; Debian 11 users should install 1.4-28+deb11u1 or newer, Debian 12 users 1.4-28+deb12u1 or newer, Debian 13 users 1.4-29 or newer, and Ubuntu 20.04/22.04 users the corresponding 1.4-28+deb10u1build0.20.04.1 or 1.4-28+deb10u1build0.22.04.1 packages.

How to confirm the fix worked

Verify the running kernel contains commit 149afee5c7418ec5db9d7387b9c9a5c1eb7ea2a8 or the distribution-specific fixed package version; confirm NVMe/RDMA reconnect succeeds after simulated controller resets under load.

Typical attack path

1. Trigger NVMe controller reset while admin queue is active
2. Keep-alive request acquires and holds the single reserved tag inside the now-quiesced queue
3. Reconnect logic attempts to allocate a tag from the shared tagset for the connect command
4. Allocation blocks forever due to the held reserved tag, preventing admin queue recovery

How to detect it

Review kernel logs for repeated NVMe admin queue reconnection failures or stalled keep-alive commands on RDMA interfaces; correlate with controller reset events and monitor for indefinite hang states in nvme_rdma or nvme_fabrics modules.

What your security team should do

• Prioritize kernel upgrades on all systems using NVMe over RDMA within the next maintenance window given the 880-day exposure window
• Temporarily disable NVMe/RDMA or implement connection monitoring and automated fallback paths where immediate patching is not feasible
• Add kernel version checks to vulnerability scanning and asset inventory processes