The Linux kernel's nvme-apple driver had a vulnerability where the admin queue allocated with blk_mq_alloc_queue() was not destroyed upon removal. The nvme_free_ctrl() function only dropped the last reference without running blk_mq_exit_queue() or blk_sync_queue(), leaving the hardware context in an inconsistent state. This caused the timeout timer and work to remain active on a queue that was about to be freed, eventually triggering a kernel panic inside blk_mq_timeout_work(). This issue only manifests when the NVMe controller fails to initialize and is immediately removed. The fix involved copying the PCIe driver's approach by unquiescing and destroying the admin queue before calling nvme_uninit_ctrl(), preventing the kernel panic.

This vulnerability can cause a kernel panic and system crash on affected systems, specifically Apple Mac mini (M1, 2020) hardware running the vulnerable Linux kernel. It results in a denial of service due to a NULL pointer dereference triggered during NVMe controller removal after a failed initialization. There is no indication of privilege escalation or data corruption beyond the system crash.

A fix is available in the Linux kernel that properly destroys the admin queue on NVMe controller removal in the nvme-apple driver. Users should update to a kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. No additional mitigations are indicated.