DocumentationOverview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: Synchronize timeout work during SQ teardown
nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work before freeing authentication state, and use it from nvmet_sq_destroy(). Keep the non-synchronous helper for in-band authentication state cleanup, where the SQ owner remains alive.
Details
- Affected product:
- AlmaLinux 9.2 ESU , TuxCare 9.6 ESU , TuxCare 9.8 ESU
- Affected packages:
- kernel @ 5.14.0 (+2 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | In Rollout |
71 kernels
|
| AlmaLinux 9 | Released |
130 kernels
|
| Debian 12 | Planned | — |
| Debian 13 | In Rollout |
17 kernels
|
| Oracle Linux 10 | In Rollout |
55 kernels
|
| Oracle Linux 9 | Released |
129 kernels
|
| RHEL 10 | In Rollout |
72 kernels
|
| RHEL 9 | Released |
128 kernels
|
| Rocky Linux 10 | In Rollout |
55 kernels
|
| Rocky Linux 9 | Released |
105 kernels
|