CVE-2026-93152: nvme-apple: Use acquire/release for queue enabled state
In the Linux kernel, the following vulnerability has been resolved:
nvme-apple: Use acquire/release for queue enabled state
applenvmeinitqueue() initializes queue state and then marks the queue enabled. The interrupt and request paths check enabled before using that queue state.
The old wmb() after WRITEONCE(enabled, true) does not publish the earlier initialization before enabled becomes visible. Use a release store when enabling the queue and acquire loads when testing it.
Although the shutdown-side enabled accesses are not used for publishing queue initialization, use helpers for them as well for consistency.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel's Apple NVMe driver are the relevant population. The provided information does not identify specific kernel versions, Apple hardware models, or distributions.
What condition triggers the vulnerability?
The issue can occur when interrupt or request paths observe a queue as enabled before the queue's earlier initialization state is visible to them. It is a concurrency and memory-ordering problem in queue enablement handling.
Is there a mitigation described if updates cannot be applied immediately?
No workaround or configuration-based mitigation is provided. The described resolution is to use release semantics when enabling a queue and acquire semantics when checking whether it is enabled.