{"id":"CVE-2026-31557","state":"PUBLISHED","title":"nvmet: move async event work off nvmet-wq","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl->async_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n  nvmet_execute_async_event()\n     queue_work(nvmet_wq, &ctrl->async_event_work)\n\n  nvmet_add_async_event()\n     queue_work(nvmet_wq, &ctrl->async_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n  nvmet_rdma_cm_handler()\n     nvmet_rdma_queue_disconnect()\n       __nvmet_rdma_queue_disconnect()\n         queue_work(nvmet_wq, &queue->release_work)\n           process_one_work()\n             lock((wq_completion)nvmet-wq)  <--------- 1st\n             nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n  nvmet_rdma_release_queue_work()\n     nvmet_rdma_free_queue()\n       nvmet_sq_destroy()\n         nvmet_ctrl_put()\n           nvmet_ctrl_free()\n             flush_work(&ctrl->async_event_work)\n               __flush_work()\n                 touch_wq_lockdep_map()\n                 lock((wq_completion)nvmet-wq) <--------- 2nd\n\nLockdep splat:\n\n  ============================================\n  WARNING: possible recursive locking detected\n  6.19.0-rc3nvme+ #14 Tainted: G                 N\n  --------------------------------------------\n  kworker/u192:42/44933 is trying to acquire lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n  but task is already holding lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n  3 locks held by kworker/u192:42/44933:\n   #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n   #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n   #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n  Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n  Call Trace:\n   __flush_work+0x268/0x530\n   nvmet_ctrl_free+0x140/0x310 [nvmet]\n   nvmet_cq_put+0x74/0x90 [nvmet]\n   nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n   nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n   process_one_work+0x206/0x660\n   worker_thread+0x184/0x320\n   kthread+0x10c/0x240\n   ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq.","publishedAt":"2026-04-24T14:35:40.544Z","updatedAt":"2026-10-30T12:24:20.397Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"ede147a85d1d4c075d13ba190453d6b09ecbea37","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"49c7c50ee6325a084216e94395e067ecde8088fa","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"ca111c9d8d6c9d5735878d933a1716c4be86c2d1","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"25ceffc1dabec3b93f458b437aae26f4da293f87","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"2922e3507f6d5caa7f1d07f145e186fc6f317a4e","versionType":"git"},{"version":"d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9","status":"affected","versionType":"git"},{"version":"84026f8c9357c62a9d3e4c554ffd10ccab813654","status":"affected","versionType":"git"},{"version":"5.15.42","status":"affected","lessThan":"5.16","versionType":"semver"},{"version":"5.17.10","status":"affected","lessThan":"5.18","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"]}],"references":["https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37","https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa","https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1","https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87","https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e"],"weaknesses":["CWE-667"],"ingestedAt":"2026-10-30T12:42:04.495Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31557.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31557","state":"PUBLISHED","datePublished":"2026-04-24T14:35:40.544Z","dateUpdated":"2026-10-30T12:24:20.397Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.116Z"},"containers":{"cna":{"title":"nvmet: move async event work off nvmet-wq","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl->async_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n  nvmet_execute_async_event()\n     queue_work(nvmet_wq, &ctrl->async_event_work)\n\n  nvmet_add_async_event()\n     queue_work(nvmet_wq, &ctrl->async_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n  nvmet_rdma_cm_handler()\n     nvmet_rdma_queue_disconnect()\n       __nvmet_rdma_queue_disconnect()\n         queue_work(nvmet_wq, &queue->release_work)\n           process_one_work()\n             lock((wq_completion)nvmet-wq)  <--------- 1st\n             nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n  nvmet_rdma_release_queue_work()\n     nvmet_rdma_free_queue()\n       nvmet_sq_destroy()\n         nvmet_ctrl_put()\n           nvmet_ctrl_free()\n             flush_work(&ctrl->async_event_work)\n               __flush_work()\n                 touch_wq_lockdep_map()\n                 lock((wq_completion)nvmet-wq) <--------- 2nd\n\nLockdep splat:\n\n  ============================================\n  WARNING: possible recursive locking detected\n  6.19.0-rc3nvme+ #14 Tainted: G                 N\n  --------------------------------------------\n  kworker/u192:42/44933 is trying to acquire lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n  but task is already holding lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n  3 locks held by kworker/u192:42/44933:\n   #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n   #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n   #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n  Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n  Call Trace:\n   __flush_work+0x268/0x530\n   nvmet_ctrl_free+0x140/0x310 [nvmet]\n   nvmet_cq_put+0x74/0x90 [nvmet]\n   nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n   nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n   process_one_work+0x206/0x660\n   worker_thread+0x184/0x320\n   kthread+0x10c/0x240\n   ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"ede147a85d1d4c075d13ba190453d6b09ecbea37","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"49c7c50ee6325a084216e94395e067ecde8088fa","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"ca111c9d8d6c9d5735878d933a1716c4be86c2d1","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"25ceffc1dabec3b93f458b437aae26f4da293f87","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"2922e3507f6d5caa7f1d07f145e186fc6f317a4e","versionType":"git"},{"version":"d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9","status":"affected","versionType":"git"},{"version":"84026f8c9357c62a9d3e4c554ffd10ccab813654","status":"affected","versionType":"git"},{"version":"5.15.42","status":"affected","lessThan":"5.16","versionType":"semver"},{"version":"5.17.10","status":"affected","lessThan":"5.18","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37"},{"url":"https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec"},{"url":"https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa"},{"url":"https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1"},{"url":"https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87"},{"url":"https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable async event and teardown path is reachable through NVMe-oF target networking, including nvmet-tcp, by connecting to the target, issuing an admin Async Event Request, and disconnecting.\nAC:L - The attacker controls both relevant actions: queuing async event work and triggering connection teardown. No uncontrollable memory layout or victim timing condition is required beyond repeating the network sequence.\nPR:N - The NVMe discovery controller is reachable with the standard discovery NQN, allows hosts by design, supports async event requests, and skips DH-HMAC-CHAP authentication. In an exposed nvmet-tcp deployment this is reachable without credentials.\nUI:N - No victim user action is needed after the target service is exposed. The remote peer can trigger the sequence by protocol messages and disconnecting.\nS:U - The impact is confined to the kernel/NVMe target host that processes the malicious connection. It does not cross a VM, IOMMU, or separate security authority boundary.\nC:N - The bug is a workqueue/flush recursion issue and does not expose kernel memory or target data. There is no identified read primitive.\nI:N - The issue does not corrupt memory or provide a write/control-flow primitive. It affects teardown/workqueue progress rather than data integrity.\nA:H - The recursive workqueue flush can trigger a kernel lockdep warning and can lead to a panic or teardown hang in hardened/debug configurations. It can be triggered repeatedly over the network, so availability impact is scored high."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:24:20.397Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-31557","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:10:53.279331Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-667","lang":"en","type":"CWE","description":"CWE-667 Improper Locking"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:55:58.971Z"}}]}}}