CVE-2024-41073

What it actually does

Double free of a special payload in the NVMe driver occurs when a discard request is retried and fails before a new payload is allocated, because RQF_SPECIAL_LOAD is not cleared on request cleanup, resulting in use-after-free.

Why it matters to the business

Systems using NVMe storage may experience kernel instability, crashes, or potential privilege escalation, disrupting Linux servers and endpoints until patched; the large number of downstream dependents increases widespread exposure risk.

How an attack unfolds

An attacker with local access crafts discard I/O patterns that force request retries in the NVMe layer; failure to allocate a replacement payload after the initial one is freed leads to reuse of freed memory, enabling memory corruption.

How to fix it

Upgrade the Linux kernel to the fixed commit 882574942a9be8b9d70d13462ddacc80c4b385ba or later stable releases containing the nvme discard payload fix; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 882574942a9be8b9d70d13462ddacc80c4b385ba via git log or version string; test discard retry paths under failure injection to verify no double-free occurs.

Typical attack path

1. Obtain local execution on a Linux system with NVMe devices
2. Trigger repeated discard requests that enter retry paths
3. Force allocation failure on retry before new payload assignment
4. Trigger use of the freed special payload structure
5. Achieve memory corruption for denial of service or escalation

How to detect it

Review kernel logs for NVMe discard-related oops or slab corruption messages; inspect request cleanup paths in nvme driver traces for repeated payload handling anomalies.

What your security team should do

• Prioritize kernel updates on all NVMe-equipped Linux systems within standard patch windows
• Monitor for new stable releases incorporating the referenced commit
• Review NVMe discard error handling in custom or embedded kernels