Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-46304— nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nvmet中nvmet_ctrl_free函数递归刷新工作队列，可能导致递归刷新。

CVSS 7.5 · High EPSS 0.44% · P37

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< ae5b0cad163833e10b271e9becc05d81dae56e5f affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< 8d66ba89480ff098a58d79003a505f383aa4e920 affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< a696fbbd5240b4ac9b166f7bd4c550882ff543f1 affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< 9a4d7222c0955b221e38bb66d10e6bccb672c8a1 affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< ee6e20c4bc9eae542a0954a368449532383169d4 affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< 781f47d641432c26c19625b2cdd7f40825097592 affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< 551f445a56a11a6457550cddcf39c9ebb8bcacc6 affected
06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5< aade8abd8b868b6ffa9697aadaea28ec7f65bee6 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46304

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain: nvmet_tcp_schedule_release_queue() kref_put(&queue->kref, nvmet_tcp_release_queue) nvmet_tcp_release_queue() queue_work(nvmet_wq, &queue->release_work) <--- nvmet_wq process_one_work() nvmet_tcp_release_queue_work() nvmet_cq_put(&queue->nvme_cq) nvmet_cq_destroy() nvmet_ctrl_put(cq->ctrl) nvmet_ctrl_free() flush_work(&ctrl->async_event_work) <--- nvmet_wq Previously Scheduled by :- nvmet_add_async_event queue_work(nvmet_wq, &ctrl->async_event_work); This trips lockdep with a possible recursive locking warning. [ 5223.015876] run blktests nvme/003 at 2026-04-07 20:53:55 [ 5223.061801] loop0: detected capacity change from 0 to 2097152 [ 5223.072206] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 [ 5223.088368] nvmet_tcp: enabling port 0 (127.0.0.1:4420) [ 5223.126086] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. [ 5223.128453] nvme nvme1: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349 [ 5233.199447] nvme nvme1: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" [ 5233.227718] ============================================ [ 5233.231283] WARNING: possible recursive locking detected [ 5233.234696] 7.0.0-rc3nvme+ #20 Tainted: G O N [ 5233.238434] -------------------------------------------- [ 5233.241852] kworker/u192:6/2413 is trying to acquire lock: [ 5233.245429] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 [ 5233.251438] but task is already holding lock: [ 5233.255254] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0 [ 5233.261125] other info that might help us debug this: [ 5233.265333] Possible unsafe locking scenario: [ 5233.269217] CPU0 [ 5233.270795] ---- [ 5233.272436] lock((wq_completion)nvmet-wq); [ 5233.275241] lock((wq_completion)nvmet-wq); [ 5233.278020] *** DEADLOCK *** [ 5233.281793] May be due to missing lock nesting notation [ 5233.286195] 3 locks held by kworker/u192:6/2413: [ 5233.289192] #0: ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0 [ 5233.294569] #1: ffffc9000e2a7e40 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x6e0 [ 5233.300128] #2: ffffffff82d7dc40 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 [ 5233.304290] stack backtrace: [ 5233.306520] CPU: 4 UID: 0 PID: 2413 Comm: kworker/u192:6 Tainted: G O N 7.0.0-rc3nvme+ #20 PREEMPT(full) [ 5233.306524] Tainted: [O]=OOT_MODULE, [N]=TEST [ 5233.306525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 5233.306527] Workqueue: nvmet-wq nvmet_tcp_release_queue_work [nvmet_tcp] [ 5233.306532] Call Trace: [ 5233.306534] <TASK> [ 5233.306536] dump_stack_lvl+0x73/0xb0 [ 5233.306552] print_deadlock_bug+0x225/0x2f0 [ 5233.306556] __lock_acquire+0x13f0/0x2290 [ 5233.306563] lock_acquire+0xd0/0x300 [ 5233.306565] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306571] ? __flush_work+0x20b/0x530 [ 5233.306573] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306577] touch_wq_lockdep_map+0x3b/0x90 [ 5233.306580] ? touch_wq_lockdep_map+0x26/0x90 [ 52 ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nvmet中nvmet_ctrl_free函数递归刷新工作队列，可能导致递归刷新。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5 ~ ae5b0cad163833e10b271e9becc05d81dae56e5f -
Linux Linux 4.10 -

II. Public POCs for CVE-2026-46304

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-46304

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46304 (7)

Same Patch Batch · Linux · 2026-06-08 · 41 CVEs total

CVE-2026-46289 9.8 CRITICAL lib/scatterlist: fix length calculations in extract_kvec_to_sg
CVE-2026-46288 8.4 HIGH of: unittest: fix use-after-free in of_unittest_changeset()
CVE-2026-46307 8.3 HIGH wifi: ath5k: do not access array OOB
CVE-2026-46303 8.2 HIGH isofs: validate Rock Ridge CE continuation extent against volume size
CVE-2026-46274 7.8 HIGH io-wq: check that the predecessor is hashed in io_wq_remove_pending()
CVE-2026-46275 7.8 HIGH Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
CVE-2026-46277 7.8 HIGH mm/zone_device: do not touch device folio after calling ->folio_free()
CVE-2026-46280 7.8 HIGH lib: test_hmm: evict device pages on file close to avoid use-after-free
CVE-2026-46311 7.8 HIGH drm/amdgpu/userq: fix access to stale wptr mapping
CVE-2026-46306 7.5 HIGH flow_dissector: do not dissect PPPoE PFC frames
CVE-2026-46299 7.0 HIGH hfsplus: fix held lock freed on hfsplus_fill_super()
CVE-2026-46296 spi: s3c64xx: fix NULL-deref on driver unbind
CVE-2026-46314 drm/v3d: Reject empty multisync extension to prevent infinite loop
CVE-2026-46298 pseries/papr-hvpipe: Fix race with interrupt handler
CVE-2026-46301 spi: topcliff-pch: fix use-after-free on unbind
CVE-2026-46302 selinux: allow multiple opens of /sys/fs/selinux/policy
CVE-2026-46305 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
CVE-2026-46308 pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
CVE-2026-46309 drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
CVE-2026-46310 media: renesas: vsp1: Fix NULL pointer deref on module unload

Showing top 20 of 41 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-46304

No comments yet

Leave a comment