CVE-2024-27435

nvme: fix reconnection fail due to reserved tag allocation

State
Published
Severity
7.5 High
Published
May 17, 2024
Updated
Aug 5, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix reconnection fail due to reserved tag allocation

We found a issue on production environment while using NVMe over RDMA, admin_q reconnect failed forever while remote target and network is ok. After dig into it, we found it may caused by a ABBA deadlock due to tag allocation. In my case, the tag was hold by a keep alive request waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the request maked as idle and will not process before reset success. As fabric_q shares tagset with admin_q, while reconnect remote target, we need a tag for connect command, but the only one reserved tag was held by keep alive command which waiting inside admin_q. As a result, we failed to reconnect admin_q forever. In order to fix this issue, I think we should keep two reserved tags for admin queue.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ed01fee283a067c72b2d6500046080dbc1bb9dae to before 149afee5c7418ec5db9d7387b9c9a5c1eb7ea2a8Affected
  • ed01fee283a067c72b2d6500046080dbc1bb9dae to before ff2f90f88d78559802466ad1c84ac5bda4416b3aAffected
  • ed01fee283a067c72b2d6500046080dbc1bb9dae to before 6851778504cdb49431809b4ba061903d5f592c96Affected
  • ed01fee283a067c72b2d6500046080dbc1bb9dae to before 262da920896e2f2ab0e3947d9dbee0aa09045818Affected
  • ed01fee283a067c72b2d6500046080dbc1bb9dae to before de105068fead55ed5c07ade75e9c8e7f86a00d1dAffected
LinuxLinux
  • 5.12Affected
  • before 5.12Not affected
  • 6.1.83 through 6.1.*Not affected
  • 6.6.23 through 6.6.*Not affected
  • 6.7.11 through 6.7.*Not affected
  • 6.8.2 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.