LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31557: nvmet: move async event work off nvmet-wq

In the Linux kernel, the following vulnerability has been resolved: nvmet: move async event work off nvmet-wq For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:- A. Async event work queued on nvmet-wq (prior to disconnect): nvmet_execute_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) nvmet_add_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) B. Full pre-work chain (RDMA CM path): nvmet_rdma_cm_handler() nvmet_rdma_queue_disconnect() __nvmet_rdma_queue_disconnect() queue_work(nvmet_wq, &queue->release_work) process_one_work() lock((wq_completion)nvmet-wq) <--------- 1st nvmet_rdma_release_queue_work() C. Recursive path (same worker): nvmet_rdma_release_queue_work() nvmet_rdma_free_queue() nvmet_sq_destroy() nvmet_ctrl_put() nvmet_ctrl_free() flush_work(&ctrl->async_event_work) __flush_work() touch_wq_lockdep_map() lock((wq_completion)nvmet-wq) <--------- 2nd Lockdep splat: ============================================ WARNING: possible recursive locking detected 6.19.0-rc3nvme+ #14 Tainted: G N -------------------------------------------- kworker/u192:42/44933 is trying to acquire lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 3 locks held by kworker/u192:42/44933: #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Call Trace: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390 Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux NVMe storage-target flaw can cause recursive workqueue locking during an RDMA disconnect, potentially making the storage service or host unavailable. It primarily matters to systems acting as NVMe targets, not ordinary Linux machines merely using NVMe drives. The supplied CVSS score is 7.5, reflecting remotely reachable denial-of-service risk without confidentiality or integrity impact.

Executive priority

Prioritize affected, network-reachable storage targets because interruption could affect dependent applications and data availability. Patch through supported Linux distribution channels promptly, with storage-owner coordination and rollback planning. Lower the priority for systems where NVMe target RDMA is absent or demonstrably disabled.

Technical view

NVMe target asynchronous-event work and RDMA queue-release work can execute on nvmet-wq. During controller cleanup, flushing async_event_work from that same worker re-enters workqueue completion and triggers recursive locking. The kernel fix moves asynchronous-event processing to a dedicated nvmet-aen-wq. The documented impact is availability loss; the supplied sources do not establish data disclosure or modification.

Likely exposure

Likely exposure is limited to Linux systems configured as NVMe targets using the nvmet RDMA path on an affected kernel. Systems that only consume NVMe storage, or do not enable this target functionality, are unlikely to reach the described path. The bundle lists affected versions, but distribution backports may make version-only assessment unreliable.

Exploitation context

The CVSS vector indicates network reachability, low complexity, and no required privileges or user interaction. However, the supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Treat practical exploitability as unconfirmed while prioritizing reachable NVMe target infrastructure because successful triggering could disrupt storage availability.

Researcher notes

The provided trace specifically follows the RDMA CM disconnect path through nvmet_rdma_release_queue_work into nvmet_ctrl_free and flush_work. The remediation separates asynchronous-event work from nvmet-wq. Exact vulnerable-to-fixed version boundaries are not fully clear from the normalized version data, so commit or distribution-advisory verification is important. No CWE was supplied.

Mitigation direction

  • Apply the vendor-supported kernel update containing the dedicated nvmet-aen-wq fix.
  • Verify distribution backport status rather than relying only on the displayed kernel version.
  • Restrict network access to NVMe target and RDMA services to authorized storage clients.
  • If patching is delayed, consider disabling unused NVMe target RDMA functionality after operational review.

Validation and detection

  • Inventory hosts configured with Linux NVMe target and nvmet_rdma functionality.
  • Compare installed kernels with vendor advisories and the supplied stable-kernel fixes.
  • Confirm the running kernel package includes the relevant fix or documented backport.
  • Review kernel logs for recursive-locking warnings, workqueue stalls, or NVMe target disconnect failures.
  • Retest authorized RDMA disconnect handling after updating, without conducting destructive availability tests.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31557 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-31557Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8832cf922151e9dfa2821736beb0ae2dd3968b6e, 8832cf922151e9dfa2821736beb0ae2dd3968b6e, 8832cf922151e9dfa2821736beb0ae2dd3968b6e, 8832cf922151e9dfa2821736beb0ae2dd3968b6e, d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9, 84026f8c9357c62a9d3e4c554ffd10ccab813654, 5.15.42, 5.17.10unaffected
LinuxLinux5.18, 0, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.