CVE-2025-21850: nvmet: Fix crash when a namespace is disabled
In the Linux kernel, the following vulnerability has been resolved:
nvmet: Fix crash when a namespace is disabled
The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running blktests/nvme/058 (eg for loop transport):
[ 2352.930426] [ T53909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI [ 2352.930431] [ T53909] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 2352.930434] [ T53909] CPU: 3 UID: 0 PID: 53909 Comm: kworker/u16:5 Tainted: G W 6.13.0-rc6 #232 [ 2352.930438] [ T53909] Tainted: [W]=WARN [ 2352.930440] [ T53909] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 2352.930443] [ T53909] Workqueue: nvmet-wq nvmeloopexecutework [nvmeloop] [ 2352.930449] [ T53909] RIP: 0010:blkcgsetioprio+0x44/0x180
as the queue is already torn down when calling submitbio();
So we need to init the percpu counter in nvmetnsenable(), and wait for it to drop to zero in nvmetnsdisable() to avoid having I/O pending after the namespace has been disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.13.0-rc6 - Configuration
In nvme target (nvmet), initialize the namespace percpu counter in nvmet_ns_enable(), so the counter exists to protect pending I/O before the namespace is used.
nvmet_ns_enable()/nvmet namespace handling (nvmet) percpu counter initialization = Initialize the percpu counter in nvmet_ns_enable() - Configuration
In nvme target (nvmet), only safely disable the namespace once the per-namespace percpu counter drops to zero. In nvmet_ns_disable(), wait for the counter to reach zero to avoid the crash scenario where the queue is torn down when submitting bio.
nvmet_ns_disable()/nvmet namespace handling (nvmet) safe namespace disable behavior = Disable namespace only after the percpu counter drops to zero; wait for counter to reach zero in nvmet_ns_disable() - Compensating control
If applicable in your operational process, delay namespace disable/unload until pending I/O has drained (i.e., until the namespace percpu counter reaches zero) to prevent submission after the queue is torn down.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21850?
CVE-2025-21850 has a moderate severity rating as it can lead to a crash in the Linux kernel when certain conditions are met.
How do I fix CVE-2025-21850?
To fix CVE-2025-21850, update your Linux kernel to the latest stable version where the vulnerability has been resolved.
What systems are affected by CVE-2025-21850?
CVE-2025-21850 affects specific versions of the Linux kernel that utilize the nvmet feature.
What happens if I don't address CVE-2025-21850?
If CVE-2025-21850 is not addressed, it may lead to system crashes during operations involving namespace disabling.
Is CVE-2025-21850 a zero-day vulnerability?
No, CVE-2025-21850 is not classified as a zero-day vulnerability since it has been publicly disclosed and resolved.