Public bug reported: Source package: linux Ubuntu series: Resolute (26.04) Reference: NVMESH-10178 Affected versions: - 7.0.0-42.42 - 7.0.0-43.43
[Impact] Ubuntu 26.04's GA Linux 7.0 kernel still contains the vulnerable NVMe cdev lifetime logic. With CONFIG_NVME_MULTIPATH=y, closing an open /dev/ngXnY descriptor after the NVMe controller has been removed can cause a use-after-free in cdev_put(), resulting in a kernel general protection fault. In NVMesh, this kills a userspace reactor and can crash or wedge the service. The failure was originally observed on Ubuntu 24.04's 6.14 HWE kernel, but Linux 7.0 remains affected. The fix entered mainline in v7.3-rc1 and Linux stable v7.2.10, but was not applied to 7.0. [Fix] Please backport these Linux 7.2.y commits, present in v7.2.15, in order: 1. 3fc78337706a87d2e83a81e000b63b3ac8050b89 "nvme: add nvme_get_ns_head()" https://github.com/gregkh/linux/commit/3fc78337706a87d2e83a81e000b63b3ac8050b89 2. 98b09ad7934482e64db4b4477d91e3bbf43adf4c "nvme: fix cdev lifetime" https://github.com/gregkh/linux/commit/98b09ad7934482e64db4b4477d91e3bbf43adf4c ** Affects: linux (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2173600 Title: [Resolute][linux] Backport NVMe cdev lifetime fix from Linux v7.2.15 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173600/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
