CVE-2024-41082

What it actually does

Exhaustion of admin_q tags prevents reg_read32/reg_read64/reg_write32 from obtaining a tag during nvme reset or IO timeout, blocking register updates in the reconnect path and causing indefinite kernel hang.

Why it matters to the business

Linux systems using NVMe over Fabrics can experience sudden, unrecoverable hangs after high command load followed by a reset, resulting in unplanned downtime and requiring manual intervention or reboot.

How an attack unfolds

A local process floods the admin queue with concurrent commands to deplete available tags; a subsequent reset or timeout triggers the reconnect routine which cannot allocate a tag for register access, leaving the controller in a permanently hung state.

How to fix it

Upgrade the Linux kernel to a version containing commit 165da9c67a26f08c9b956c15d701da7690f45bcb or later; apply the stable update that reserves tags for reg_read/write operations in the nvme-fabrics driver.

How to confirm the fix worked

Confirm the running kernel contains commit 165da9c67a26f08c9b956c15d701da7690f45bcb; verify that reg_read32/reg_read64/reg_write32 now use reserved tags by inspecting the nvme-fabrics source or running targeted stress tests that combine high command volume with resets.

Typical attack path

1. Issue large numbers of concurrent NVMe admin or I/O commands from user space to exhaust admin_q tags
2. Trigger a controller reset or allow an IO timeout to occur
3. Observe failure of the reconnect path to perform register read/write operations
4. Cause the kernel to hang indefinitely

How to detect it

Review kernel logs for repeated nvme reset or reconnect failures that coincide with high admin queue utilization; look for processes issuing bursts of NVMe commands immediately before a hang.

What your security team should do

• Prioritize kernel updates on all systems using NVMe over Fabrics within the next maintenance window
• Monitor EPSS trend and any new exploit reports for this DoS class
• Limit untrusted local processes from issuing large numbers of NVMe commands until patched