CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free

In the Linux kernel, the following vulnerability has been resolved:

nvmet: avoid recursive nvmet-wq flush in nvmetctrlfree

nvmettcpreleasequeuework() runs on nvmet-wq and can drop the final controller reference through nvmetcqput(). If that triggers nvmetctrlfree(), the teardown path flushes ctrl->asynceventwork on the same nvmet-wq.

Call chain:

nvmettcpschedulereleasequeue() krefput(&queue->kref, nvmettcpreleasequeue) nvmettcpreleasequeue() queuework(nvmetwq, &queue->releasework) <--- nvmetwq processonework() nvmettcpreleasequeuework() nvmetcqput(&queue->nvmecq) nvmetcqdestroy() nvmetctrlput(cq->ctrl) nvmetctrlfree() flushwork(&ctrl->asynceventwork) <--- nvmetwq

Previously Scheduled by :- nvmetaddasyncevent queuework(nvmetwq, &ctrl->asynceventwork);

This trips lockdep with a possible recursive locking warning.

[ 5223.015876] run blktests nvme/003 at 2026-04-07 20:53:55 [ 5223.061801] loop0: detected capacity change from 0 to 2097152 [ 5223.072206] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 [ 5223.088368] nvmettcp: enabling port 0 (127.0.0.1:4420) [ 5223.126086] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. [ 5223.128453] nvme nvme1: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349 [ 5233.199447] nvme nvme1: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery"

[ 5233.227718] ============================================ [ 5233.231283] WARNING: possible recursive locking detected [ 5233.234696] 7.0.0-rc3nvme+ #20 Tainted: G O N [ 5233.238434] -------------------------------------------- [ 5233.241852] kworker/u192:6/2413 is trying to acquire lock: [ 5233.245429] ffff888111632548 ((wqcompletion)nvmet-wq){+.+.}-{0:0}, at: touchwqlockdepmap+0x26/0x90 [ 5233.251438] but task is already holding lock: [ 5233.255254] ffff888111632548 ((wqcompletion)nvmet-wq){+.+.}-{0:0}, at: processonework+0x5cc/0x6e0 [ 5233.261125] other info that might help us debug this: [ 5233.265333] Possible unsafe locking scenario:

[ 5233.269217] CPU0 [ 5233.270795] ---- [ 5233.272436] lock((wqcompletion)nvmet-wq); [ 5233.275241] lock((wqcompletion)nvmet-wq); [ 5233.278020] DEADLOCK

[ 5233.281793] May be due to missing lock nesting notation

[ 5233.286195] 3 locks held by kworker/u192:6/2413: [ 5233.289192] #0: ffff888111632548 ((wqcompletion)nvmet-wq){+.+.}-{0:0}, at: processonework+0x5cc/0x6e0 [ 5233.294569] #1: ffffc9000e2a7e40 ((workcompletion)(&queue->releasework)){+.+.}-{0:0}, at: processonework+0x1c5/0x6e0 [ 5233.300128] #2: ffffffff82d7dc40 (rcureadlock){....}-{1:3}, at: flushwork+0x62/0x530 [ 5233.304290] stack backtrace: [ 5233.306520] CPU: 4 UID: 0 PID: 2413 Comm: kworker/u192:6 Tainted: G O N 7.0.0-rc3nvme+ #20 PREEMPT(full) [ 5233.306524] Tainted: [O]=OOTMODULE, [N]=TEST [ 5233.306525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 5233.306527] Workqueue: nvmet-wq nvmettcpreleasequeuework [nvmettcp] [ 5233.306532] Call Trace: [ 5233.306534] <TASK> [ 5233.306536] dumpstacklvl+0x73/0xb0 [ 5233.306552] printdeadlockbug+0x225/0x2f0 [ 5233.306556] lockacquire+0x13f0/0x2290 [ 5233.306563] lockacquire+0xd0/0x300 [ 5233.306565] ? touchwqlockdepmap+0x26/0x90 [ 5233.306571] ? flushwork+0x20b/0x530 [ 5233.306573] ? touchwqlockdepmap+0x26/0x90 [ 5233.306577] touchwqlockdepmap+0x3b/0x90 [ 5233.306580] ? touchwqlockdepmap+0x26/0x90 [ 52 ---truncated---