CVE-2024-53169

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-fabrics: fix kernel crash while shutting down controller

The nvme keep-alive operation, which executes at a periodic interval,

could potentially sneak in while shutting down a fabric controller.

This may lead to a race between the fabric controller admin queue

destroy code path (invoked while shutting down controller) and hw/hctx

queue dispatcher called from the nvme keep-alive async request queuing

operation. This race could lead to the kernel crash shown below:

Call Trace:

autoremove_wake_function+0x0/0xbc (unreliable)

__blk_mq_sched_dispatch_requests+0x114/0x24c

blk_mq_sched_dispatch_requests+0x44/0x84

blk_mq_run_hw_queue+0x140/0x220

nvme_keep_alive_work+0xc8/0x19c [nvme_core]

process_one_work+0x200/0x4e0

worker_thread+0x340/0x504

kthread+0x138/0x140

start_kernel_thread+0x14/0x18

While shutting down fabric controller, if nvme keep-alive request sneaks

in then it would be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References