Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-31557high7.5

nvmet: move async event work off nvmet-wq

Impact

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Linux · Linux

Linux

10 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

8832cf922151e9dfa2821736beb0ae2dd3968b6e → before ede147a85d1d4c075d13ba190453d6b09ecbea37

git versions

8832cf922151e9dfa2821736beb0ae2dd3968b6e → before a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec

git versions

8832cf922151e9dfa2821736beb0ae2dd3968b6e → before 49c7c50ee6325a084216e94395e067ecde8088fa

git versions

8832cf922151e9dfa2821736beb0ae2dd3968b6e → before ca111c9d8d6c9d5735878d933a1716c4be86c2d1

git versions

8832cf922151e9dfa2821736beb0ae2dd3968b6e → before 25ceffc1dabec3b93f458b437aae26f4da293f87

git versions

8832cf922151e9dfa2821736beb0ae2dd3968b6e → before 2922e3507f6d5caa7f1d07f145e186fc6f317a4e

git versions

d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9

git versions

84026f8c9357c62a9d3e4c554ffd10ccab813654

git versions

5.15.42 → before 5.16

semver versions

5.17.10 → before 5.18

semver versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

8 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.18

unaffected

0 → before 5.18

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.160 → through 6.6.*

semver versions

6.12.80 → through 6.12.*

semver versions

6.18.21 → through 6.18.*

semver versions

6.19.11 → through 6.19.*

semver versions

7.0 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Original source description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: move async event work off nvmet-wq

For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:-

A. Async event work queued on nvmet-wq (prior to disconnect): nvmet_execute_async_event() queue_work(nvmet_wq, &ctrl->async_event_work)

nvmet_add_async_event() queue_work(nvmet_wq, &ctrl->async_event_work)

B. Full pre-work chain (RDMA CM path): nvmet_rdma_cm_handler() nvmet_rdma_queue_disconnect() __nvmet_rdma_queue_disconnect() queue_work(nvmet_wq, &queue->release_work) process_one_work() lock((wq_completion)nvmet-wq) <--------- 1st nvmet_rdma_release_queue_work()

C. Recursive path (same worker): nvmet_rdma_release_queue_work() nvmet_rdma_free_queue() nvmet_sq_destroy() nvmet_ctrl_put() nvmet_ctrl_free() flush_work(&ctrl->async_event_work) __flush_work() touch_wq_lockdep_map() lock((wq_completion)nvmet-wq) <--------- 2nd

Lockdep splat:

============================================ WARNING: possible recursive locking detected 6.19.0-rc3nvme+ #14 Tainted: G N

kworker/u192:42/44933 is trying to acquire lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90

but task is already holding lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660

3 locks held by kworker/u192:42/44933: #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530

Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Call Trace: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390

Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-31557

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-667 ↗

CWE-667 Improper Locking

CISA-ADP

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.18

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.18

Before: 6.6.160

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.18

Before: 6.12.80

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.18

Before: 6.18.21

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.18

Before: 6.19.11

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.18

Before: 7.0

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.15.42

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.17.10

Original applicability statements
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.18",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.18",
            "versionEndExcluding": "6.6.160"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.18",
            "versionEndExcluding": "6.12.80"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.18",
            "versionEndExcluding": "6.18.21"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.18",
            "versionEndExcluding": "6.19.11"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.18",
            "versionEndExcluding": "7.0"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.15.42"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.17.10"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 2
Linux

Assigning organization

2026-10-30
CISA-ADP

Additional data publisher

2026-10-19

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

6 sources
git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37
Source referenceLinux
git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec
Source referenceLinux
git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa
Source referenceLinux
git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1
Source referenceLinux
git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87
Source referenceLinux
git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e
Source referenceLinux