CVE-2026-46304

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free

nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the

final controller reference through nvmet_cq_put(). If that triggers

nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on

the same nvmet-wq.

Call chain:

nvmet_tcp_schedule_release_queue()

kref_put(&queue->kref, nvmet_tcp_release_queue)

nvmet_tcp_release_queue()

queue_work(nvmet_wq, &queue->release_work) <--- nvmet_wq

process_one_work()

nvmet_tcp_release_queue_work()

nvmet_cq_put(&queue->nvme_cq)

nvmet_cq_destroy()

nvmet_ctrl_put(cq->ctrl)

nvmet_ctrl_free()

flush_work(&ctrl->async_event_work) <--- nvmet_wq

Previously Scheduled by :-

nvmet_add_async_event

queue_work(nvmet_wq, &ctrl->async_event_work);

This trips lock

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References