CVE-2026-98815: nvme: fix cdev lifetime

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix cdev lifetime

Sashiko bot reported a potential problem for the cdev lifetime in [0] - the code there is heavily based on the NVMe code.

Currently the NS head .open and .release fileoperations methods take and put a reference to the nvmenshead to ensure that this structure does not disappear while we open fds for that cdev.

In multipath mode, when we teardown the NS head, we call nvmecdevdel() -> cdevdevicedel() -> cdevdel(). However after cdevdel() returns, cdevs already open will remain and their fops will still be callable. As such, we can still reference the cdev after the nvmenshead reference count drops to 0 (and is freed).

This can be shown with an application which delays between opening the cdev and issuing the ioctl while the NS head is being torn down:

./ioctlfile /dev/ng1n1 & waiting 10 seconds ....

./ininvmeteardown.sh [ 21.221718] nvme nvme1: Removing ctrl: NQN "nvme-test-target" [ 21.274609] nvme nvme2: Removing ctrl: NQN "nvme-test-target" now going to issue ioctl .... [ 26.549285] ================================================================== [ 26.550841] BUG: KASAN: slab-use-after-free in cdevput.part.0+0x3d/0x40 [ 26.552352] Read of size 8 at addr ffff88811e7fa170 by task ioctlfile/237 [ 26.553805] [ 26.554227] CPU: 3 UID: 0 PID: 237 Comm: ioctlfile Not tainted 7.2.0-rc1-00004-g6852a10e32d4 #921 PREEMPT(lazy) [ 26.554236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.554241] Call Trace: [ 26.554245] <TASK> [ 26.554248] dumpstacklvl+0x68/0xa0 [ 26.554266] printreport+0x10d/0x5d0 [ 26.554276] ? virtaddrvalid+0x21d/0x3f0 [ 26.554287] ? cdevput.part.0+0x3d/0x40 [ 26.554292] kasanreport+0x96/0xd0 [ 26.554300] ? cdevput.part.0+0x3d/0x40 [ 26.554307] cdevput.part.0+0x3d/0x40 [ 26.554313] fput+0x7bc/0xa70 [ 26.554322] fputclosesync+0xd8/0x190 [ 26.554328] ? pfxfputclosesync+0x10/0x10 [ 26.554337] x64sysclose+0x79/0xd0 [ 26.554344] dosyscall64+0x117/0x6b0 [ 26.554351] entrySYSCALL64afterhwframe+0x77/0x7f [ 26.554358] RIP: 0033:0x7f938c067727 [ 26.554364] Code: 48 89 fa 4c 89 df e8 28 ad 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5bf [ 26.554369] RSP: 002b:00007fff49f05980 EFLAGS: 00000202 ORIGRAX: 0000000000000003 [ 26.554376] RAX: ffffffffffffffda RBX: 00007f938bfd7780 RCX: 00007f938c067727 [ 26.554380] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 26.554383] RBP: 00007fff49f05a10 R08: 0000000000000000 R09: 0000000000000000 [ 26.554386] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 26.554389] R13: 00007fff49f05b40 R14: 00007f938c207000 R15: 000055c148471d78 [ 26.554397] </TASK> [ 26.554399] [ 26.575612] Allocated by task 100: [ 26.575871] kasansavestack+0x24/0x50 [ 26.576157] kasansavetrack+0x14/0x30 [ 26.576418] kasankmalloc+0x7f/0x90 [ 26.576668] kmallocnoprof+0x281/0x6c0 [ 26.576938] nvmeallocns+0x7f7/0x3170 [ 26.577206] nvmescanns+0x508/0x880 [ 26.577449] asyncrunentryfn+0x8c/0x350 [ 26.577723] processscheduledworks+0xb6f/0x1a00 [ 26.578034] workerthread+0x4ad/0xb40 [ 26.578283] kthread+0x34f/0x450 [ 26.578501] retfromfork+0x563/0x800 [ 26.578752] retfromforkasm+0x1a/0x30 [ 26.579012] [ 26.579124] Freed by task 237: [ 26.579335] kasansavestack+0x24/0x50 [ 26.579596] kasansavetrack+0x14/0x30 [ 26.579855] kasansavefreeinfo+0x3a/0x60 [ 26.580131] kasanslabfree+0x43/0x70 [ 26.580388] kfree+0x321/0x500 [ 26.580591] nvmensheadchrrelease+0x39/0x50 [ 26.580883] fput+0x352/0xa70 [ 26.581095] fputclosesync+0xd8/0x190 [ 26.581350] x64sysclose+0x79/0xd0 [ 26.581595] dosyscall64+0x117/0x6b0 [ 26.581842] entrySYSCAL ---truncated---