CVE-2025-68265
Description
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin request_queue lifetime
The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:
BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace:
dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A use-after-free in the Linux kernel's NVMe driver, caused by namespace references to the admin request_queue persisting after controller teardown, is fixed by deferring the controller put reordering.
Vulnerability
A use-after-free vulnerability exists in the Linux kernel's NVMe driver, specifically in the management of the admin request_queue lifetime. The root cause is that namespaces can retain references to the controller's admin request_queue after the controller has been torn down. This leads to a race condition where a stale pointer is accessed, triggering a slab-use-after-free error as observed in the provided KASAN report [1].
Exploitation
The bug is triggered when a user submits an NVMe admin command via the nvme character device (e.g., through ioctl syscalls) after the controller has been removed or reset. No special privileges beyond local access to the NVMe device are required, as the attack surface is the standard NVMe ioctl interface. The exploit path involves blk_queue_enter, blk_mq_alloc_request, and nvme_submit_user_cmd on a freed request_queue [1].
Impact
An attacker with local access can trigger a kernel crash (denial of service) by exploiting this use-after-free. In the reported trace, the kernel panics with a KASAN error, leading to system instability. The vulnerability is rated with a CVSS score of 5.5, indicating a medium severity impact on availability [1].
Mitigation
The fix, committed to the Linux kernel stable branch, reorders the controller's reference counting: the put of the controller is moved to after all namespace references are released, ensuring the admin request_queue remains valid during any potential access. Users should update their kernel to include commit e7dac6817905 (stable) or 4896491c4972 (mainline) to remediate this issue [2].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0nvd
- git.kernel.org/stable/c/4896491c497226022626c3acc46044fd182f943cnvd
- git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6cnvd
- git.kernel.org/stable/c/e7dac681790556c131854b97551337aa8042215bnvd
- git.kernel.org/stable/c/e8061d02b49c5c901980f58d91e96580e9a14acfnvd
News mentions
0No linked articles in our index yet.