High 7.5Published Apr 24, 2026

CVE-2026-31557nvmet: move async event work off nvmet-wq

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvmet: move async event work off nvmet-wq For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:- A. Async event work queued on nvmet-wq (prior to disconnect): nvmet_execute_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) nvmet_add_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) B. Full pre-work chain (RDMA CM path): nvmet_rdma_cm_handler() nvmet_rdma_queue_disconnect() __nvmet_rdma_queue_disconnect() queue_work(nvmet_wq, &queue->release_work) process_one_work() lock((wq_completion)nvmet-wq) <--------- 1st nvmet_rdma_release_queue_work() C. Recursive path (same worker): nvmet_rdma_release_queue_work() nvmet_rdma_free_queue() nvmet_sq_destroy() nvmet_ctrl_put() nvmet_ctrl_free() flush_work(&ctrl->async_event_work) __flush_work() touch_wq_lockdep_map() lock((wq_completion)nvmet-wq) <--------- 2nd Lockdep splat: ============================================ WARNING: possible recursive locking detected 6.19.0-rc3nvme+ #14 Tainted: G N -------------------------------------------- kworker/u192:42/44933 is trying to acquire lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 3 locks held by kworker/u192:42/44933: #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Call Trace: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390 Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	8832cf922151e9dfa2821736beb0ae2dd3968b6e builds before 49c7c50ee6325a084216e94395e067ecde8088fa; from 8832cf922151e9dfa2821736beb0ae2dd3968b6e before ca111c9d8d6c9d5735878d933a1716c4be86c2d1; 8832cf922151e9dfa2821736beb0ae2dd3968b6e builds before 25ceffc1dabec3b93f458b437aae26f4da293f87; 8832cf922151e9dfa2821736beb0ae2dd3968b6e builds before 2922e3507f6d5caa7f1d07f145e186fc6f317a4e; d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9; 84026f8c9357c62a9d3e4c554ffd10ccab813654; from 5.15.42 before 5.16; from 5.17.10 before 5.18	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.42 before 5.16; from 5.17.10 before 5.18; from 5.18.1 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 5.18; 7.0; 7.0; and 5 more ranges	NVD

References

https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fapatch
https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1patch
https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87patch
https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4epatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.