CVE-2026-31557
- Source
- https://cve.org/CVERecord?id=CVE-2026-31557
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31557.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-31557
- Downstream
- Published
- 2026-04-24T14:35:40.544Z
- Modified
- 2026-05-18T05:59:51.036269557Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- nvmet: move async event work off nvmet-wq
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nvmet: move async event work off nvmet-wq
For target nvmetctrlfree() flushes ctrl->asynceventwork. If nvmetctrlfree() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:-
A. Async event work queued on nvmet-wq (prior to disconnect): nvmetexecuteasyncevent() queuework(nvmetwq, &ctrl->asyncevent_work)
nvmetaddasyncevent() queuework(nvmetwq, &ctrl->asyncevent_work)
B. Full pre-work chain (RDMA CM path): nvmetrdmacmhandler() nvmetrdmaqueuedisconnect() _nvmetrdmaqueuedisconnect() queuework(nvmetwq, &queue->releasework) processonework() lock((wqcompletion)nvmet-wq) <--------- 1st nvmetrdmareleasequeuework()
C. Recursive path (same worker): nvmetrdmareleasequeuework() nvmetrdmafreequeue() nvmetsqdestroy() nvmetctrlput() nvmetctrlfree() flushwork(&ctrl->asynceventwork) _flushwork() touchwqlockdepmap() lock((wqcompletion)nvmet-wq) <--------- 2nd
Lockdep splat:
============================================ WARNING: possible recursive locking detected 6.19.0-rc3nvme+ #14 Tainted: G N
kworker/u192:42/44933 is trying to acquire lock: ffff888118a00948 ((wqcompletion)nvmet-wq){+.+.}-{0:0}, at: touchwqlockdepmap+0x26/0x90
but task is already holding lock: ffff888118a00948 ((wqcompletion)nvmet-wq){+.+.}-{0:0}, at: processone_work+0x53e/0x660
3 locks held by kworker/u192:42/44933: #0: ffff888118a00948 ((wqcompletion)nvmet-wq){+.+.}-{0:0}, at: processonework+0x53e/0x660 #1: ffffc9000e6cbe28 ((workcompletion)(&queue->releasework)){+.+.}-{0:0}, at: processonework+0x1c5/0x660 #2: ffffffff82d4db60 (rcuread_lock){....}-{1:3}, at: _flushwork+0x62/0x530
Workqueue: nvmet-wq nvmetrdmareleasequeuework [nvmet_rdma] Call Trace: _flushwork+0x268/0x530 nvmetctrlfree+0x140/0x310 [nvmet] nvmetcqput+0x74/0x90 [nvmet] nvmetrdmafreequeue+0x23/0xe0 [nvmetrdma] nvmetrdmareleasequeuework+0x19/0x50 [nvmetrdma] processonework+0x206/0x660 workerthread+0x184/0x320 kthread+0x10c/0x240 retfromfork+0x319/0x390
Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31557.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87
- https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e
- https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa
- https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31557.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31557
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8832cf922151e9dfa2821736beb0ae2dd3968b6eFixed49c7c50ee6325a084216e94395e067ecde8088faFixedca111c9d8d6c9d5735878d933a1716c4be86c2d1Fixed25ceffc1dabec3b93f458b437aae26f4da293f87Fixed2922e3507f6d5caa7f1d07f145e186fc6f317a4e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedd44ff3b100b94e9f23b1e8dbe688eee9bb867ac9Last affected84026f8c9357c62a9d3e4c554ffd10ccab813654