CVE-2024-49569

What it actually does

Failure to unquiesce the admin queue before destroying it in nvme-rdma controller creation error paths causes indefinite hang in blk_mq_freeze_queue_wait during request drain.

Why it matters to the business

Systems relying on NVMe over RDMA storage may experience kernel-level hangs on controller setup failures, resulting in service disruption and forced reboots without data loss.

How an attack unfolds

An attacker or misconfigured environment triggers nvme-rdma controller creation via nvmf_dev_write that fails after quiescing the admin queue but omits the unquiesce step, causing the kernel to hang while attempting to freeze and drain the queue.

How to fix it

Upgrade the Linux kernel to a version containing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 which reuses nvme_rdma_teardown_admin_queue to ensure unquiesce occurs before destroy.

How to confirm the fix worked

Confirm kernel source contains the referenced commit; test nvme-rdma controller creation failure scenarios to verify the hang no longer occurs and admin_q is properly unquiesced.

Typical attack path

1. Initiate NVMe-oF RDMA controller creation that encounters an error path
2. Quiesce admin queue before request cancellation
3. Attempt nvme_rdma_destroy_admin_queue without prior unquiesce
4. Kernel blocks indefinitely in blk_mq_freeze_queue_wait

How to detect it

Inspect kernel logs and crash dumps for call traces containing nvme_rdma_destroy_admin_queue, blk_mq_freeze_queue_wait, and nvme_rdma_setup_ctrl; correlate with failed controller creation attempts.

What your security team should do

• Prioritize kernel update on all systems using NVMe over RDMA
• Monitor for nvme_rdma related kernel stack traces indicating hangs
• Apply the fix across distributions shipping affected kernel versions