CVE-2024-41082

nvme-fabrics: use reserved tag for reg read/write command

MEDIUM
5.5
CVSS Score
Published: July 29, 2024 at 03:04 PM UTC
Updated: October 30, 2026 at 01:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of admin_q. If a reset (nvme reset or IO timeout) occurs before these commands finish, reconnect routine may fail to update nvme regs due to insufficient tags, which will cause kernel hang forever. In order to workaround this issue, maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved tags. This maybe safe for nvmf: 1. For the disable ctrl path, we will not issue connect command 2. For the enable ctrl / fw activate path, since connect and reg_xx() are called serially. So the reserved tags may still be enough while reg_xx() use reserved tags.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 6.9.116.106.10 rc16.10 rc2e7832cb48a654cd12b2bc9181b2f0ad49d526ac6
Vendor states this is fixed in 165da9c67a26f08c9b956c15d701da7690f45bcb (fixed)
Vendor states this is fixed in 7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa (fixed)
Vendor states this is fixed in cc91c461cf3902993364ea85d8814ba7786c95b1 (fixed)
Vendor states this is fixed in 5.4 (unaffected)
Vendor states this is fixed in 6.1.191 (unaffected)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.6.158 (unaffected)
Vendor states this is fixed in 6.9.11 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card