CVE-2024-27435: nvme: fix reconnection fail due to reserved tag allocation

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-17 · updated 2026-08-04
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, admin_q reconnect failed forever while remote target and network is ok. After dig into it, we found it may caused by a ABBA deadlock due to tag allocation. In my case, the tag was hold by a keep alive request waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the request maked as idle and will not process before reset success. As fabric_q shares tagset with admin_q, while reconnect remote target, we need a tag for connect command, but the only one reserved tag was held by keep alive command which waiting inside admin_q. As a result, we failed to reconnect admin_q forever. In order to fix this issue, I think we should keep two reserved tags for admin queue.

Affected products

Linux kernel: from 5.12.1 before 6.1.83; from 6.2 before 6.6.23; from 6.7 before 6.7.11; from 6.8 before 6.8.2; 5.12, 5.12-rc4, 5.12-rc5, 5.12-rc6, 5.12-rc7, 5.12-rc8 — fixed in 6.1.83, 6.6.23, 6.7.11, 6.8.2

How to fix

Upgrade to a fixed version: Linux kernel 6.1.83, 6.6.23, 6.7.11, 6.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-27435 or the next vulnerability affects your stack