The Linux kernel's nvdimm/btt subsystem serializes access to per-lane metadata and workspace state during BTT I/O using lanes. A race condition was identified where the existing spinlock-based recursion model failed to handle preemption properly, allowing concurrent access to the same lane by different tasks on the same CPU. This race could cause silent data corruption during BTT writes, as reported by the btt-check unit test. Additionally, some flush callbacks could sleep, making spinlocks inappropriate for lane locking. The vulnerability was addressed by replacing the spinlock and recursion count with a dynamically allocated per-lane mutex array, enforcing unconditional lane locking, and adding might_sleep() checks to catch improper atomic-context calls. The issue was discovered through the ndctl unit test btt-check.sh.

The vulnerability could lead to silent data corruption during BTT write operations in the Linux kernel due to concurrent access to the same lane caused by improper locking under preemption. This undermines data integrity for systems using the nvdimm/btt subsystem.

A fix has been implemented in the Linux kernel replacing the spinlock-based lane locking with a per-lane mutex array and adding checks to prevent improper atomic-context usage. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel release notes for the specific patch availability and version details.