CVE-2024-46737

What it actually does

NULL pointer dereference in nvmet_tcp_release_queue_work() after nvmet_tcp_alloc_cmds() fails to allocate commands, resulting in kernel panic on NVMe over TCP targets.

Why it matters to the business

Unexpected crashes on Linux systems configured as NVMe over TCP storage targets can interrupt services, cause data unavailability, and require reboots or patches, with urgency for organizations running affected kernel versions in storage or cloud environments.

How an attack unfolds

An attacker with access to trigger NVMe/TCP queue allocation (such as via malformed or high-volume connection attempts) forces nvmet_tcp_alloc_cmds() to fail, after which nvmet_tcp_release_queue_work() dereferences a NULL pointer and crashes the kernel.

How to fix it

Apply the upstream fix by updating the Linux kernel to include commit 03e1fd0327fa5e2174567f5fe9290fe21d21b8f4 or later stable releases that set queue->nr_cmds to zero on allocation failure.

How to confirm the fix worked

Confirm the patch is present by checking git history for commit 03e1fd0327fa5e2174567f5fe9290fe21d21b8f4, verify kernel logs no longer show the NULL dereference after simulated allocation failures, and test nvmet-tcp queue initialization under memory pressure.

Typical attack path

1. Establish NVMe over TCP connection to trigger queue setup
2. Force command allocation failure in nvmet_tcp_alloc_cmds()
3. Invoke nvmet_tcp_release_queue_work() on the partially initialized queue
4. Trigger NULL pointer dereference leading to kernel panic

How to detect it

Search kernel logs for messages indicating failed nvmet queue installation followed immediately by NULL pointer dereference faults; correlate with nvmet-tcp module activity and any preceding allocation-related errors.

• nvmet: failed to install queue 0 cntlid 1 ret 6
• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

What your security team should do

• Prioritize kernel updates to the fixed commit on all NVMe over TCP target systems
• Review and restrict NVMe/TCP exposure to trusted networks only
• Enable kernel panic logging and monitoring for early detection of related crashes