CVE-2024-42152 is a vulnerability identified in the Linux kernel's NVMe target (nvmet) subsystem, specifically related to the handling of controller (ctrl) destruction during queue pair (qp) establishment. The issue arises in the nvmet_sq_destroy function, which is responsible for cleaning up submission queues (sq) and their associated controllers. The vulnerability is a race condition that can occur when a client disconnects while the admin connect command is still in an early stage of processing. In this scenario, the ctrl object is allocated but the final reference drop on the ctrl does not occur due to a timing window where nvmet_sq_destroy captures the ctrl pointer early and proceeds without re-checking it after all inflight requests complete. This leads to a possible resource leak where the ctrl object is not properly released. The root cause is the concurrent execution of nvmet_sq_destroy triggered by client disconnection and the admin connect command handling, which creates a small window where the ctrl reference management is inconsistent. This vulnerability was observed in environments with many hosts connecting multiple controllers simultaneously, causing delays in ctrl allocation and increasing the likelihood of hitting this race condition. The fix involves re-capturing the sq->ctrl pointer after all inflight requests have completed to ensure the final reference drop on the ctrl is correctly performed, thus preventing the leak. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, especially those operating data centers, cloud services, or storage infrastructures relying on Linux servers with NVMe target support, this vulnerability could lead to resource exhaustion due to leaked controller references. Over time, this leak may degrade system performance, cause instability, or lead to denial of service conditions if the kernel runs out of resources to allocate new controllers or queues. Although the vulnerability does not directly allow code execution or privilege escalation, the resulting resource leak can disrupt critical storage services, impacting availability and reliability. Organizations with high-density NVMe target deployments or those supporting multiple simultaneous NVMe connections are at greater risk. The impact is primarily on availability and system stability rather than confidentiality or integrity. Since exploitation requires specific conditions involving multiple hosts connecting simultaneously and client disconnections during admin connect commands, the risk is more pronounced in large-scale or multi-tenant environments common in European cloud providers and enterprises.

European organizations should promptly apply the Linux kernel patch that addresses CVE-2024-42152 once it is available from their Linux distribution vendors. Until patched, administrators should monitor nvmet subsystem logs for signs of abnormal controller reference counts or resource leaks. Limiting the number of simultaneous NVMe target connections or implementing connection throttling can reduce the race window exposure. Additionally, organizations should audit their NVMe target usage patterns to identify high concurrency scenarios and consider isolating critical NVMe services on dedicated hosts to minimize impact. Employing kernel live patching solutions where supported can reduce downtime during remediation. Regular kernel updates and testing in staging environments are essential to ensure stability and security. Finally, maintaining robust monitoring and alerting on kernel resource usage will help detect early signs of exploitation or system degradation.