CVE-2024-41082: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's NVMe-fabrics subsystem was discovered and assigned CVE-2024-41082. The issue involves the handling of command tags in the NVMe fabric driver, where under certain conditions, if too many commands are issued simultaneously by user tasks, it can exhaust all tags of admin_q. This vulnerability was disclosed on July 29, 2024, affecting Linux kernel systems using NVMe-fabrics (Kernel Git).

The vulnerability occurs when multiple NVMe commands are issued simultaneously, potentially exhausting all available tags in the admin queue. If a reset (either NVMe reset or IO timeout) occurs before these commands complete, the reconnect routine may fail to update NVMe registers due to insufficient tags. This condition can result in an indefinite kernel hang. The issue specifically affects the reg_read32(), reg_read64(), and reg_write32() functions in the NVMe-fabrics driver (Kernel Git).

When successfully triggered, this vulnerability can cause the Linux kernel to hang indefinitely, resulting in a system-wide denial of service. This occurs specifically during the reconnect routine when attempting to update NVMe registers after a reset operation (NVD).

The vulnerability requires specific conditions to be exploited, namely the simultaneous issuance of multiple NVMe commands that exhaust the admin queue tags, followed by a reset operation. The issue is particularly relevant in environments with heavy NVMe-fabrics usage (Ubuntu Security).

The issue has been resolved by implementing a fix that uses reserved tags for register read/write commands. The fix ensures that reg_read32(), reg_read64(), and reg_write32() operations use reserved tags, which is considered safe for NVMe-fabrics as connect and register operations are called serially. This solution has been incorporated into various Linux distributions, including Ubuntu 24.04 LTS and 22.04 LTS (Ubuntu Security Notice).