CVE-2024-42152

What it actually does

Race condition in nvmet_sq_destroy allows capture of sq->ctrl before final reference confirmation during concurrent admin connect processing, preventing the final reference drop and leaking nvmet_ctrl resources.

Why it matters to the business

Systems running Linux as NVMe targets under high connection concurrency may experience gradual resource exhaustion leading to service disruption or the need for reboots; prevalence in storage ecosystems increases exposure for dependent workloads.

How an attack unfolds

An attacker initiates multiple simultaneous NVMe admin connections to trigger the race window where nvmet_sq_destroy starts before kill_and_confirm completes on sq->ref, leaving allocated ctrl references unreleased; threat actor campaigns targeting Linux kernel resource issues could leverage similar patterns in high-load environments.

How to fix it

Apply the kernel patch containing commit 2f3c22b1d3d7e86712253244797a651998c141fa; rebuild and deploy updated kernels on all affected NVMe target systems; prioritize patching given the 805 days since publication and storage ecosystem prevalence.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree or verify the kernel version incorporates 2f3c22b1d3d7e86712253244797a651998c141fa; test concurrent connection workloads to ensure no reference leaks occur.

Typical attack path

1. Initiate concurrent NVMe admin connect commands from multiple hosts or clients
2. Trigger client disconnection during early-stage controller allocation
3. Repeat the pattern to widen the race window and accumulate unreleased references

How to detect it

Monitor kernel memory usage and nvmet controller object counts for unexplained growth during connection spikes; inspect logs for nvmet-related allocation or reference errors under concurrent load from multiple hosts.

What your security team should do

• Immediately schedule kernel updates containing the referenced commit on all nvmet-enabled systems
• Implement connection rate limiting and monitoring for NVMe target endpoints
• Conduct load testing simulating many-host concurrent connects before production rollout