CVE-2024-41082 describes a Linux kernel vulnerability in the nvme-fabrics component where issuing too many NVMe admin queue commands simultaneously can exhaust all tags. If a reset (such as nvme reset or IO timeout) happens before these commands complete, the reconnect routine may fail to update NVMe registers due to lack of tags, causing the kernel to hang indefinitely. The fix involves using reserved tags for register read/write commands (reg_read32(), reg_read64(), reg_write32()), which is safe because connect and register commands are called serially and reserved tags remain available.

The vulnerability can cause a kernel hang (denial of service) when the NVMe admin queue tags are exhausted and a reset occurs before command completion. There is no impact on confidentiality or integrity. The CVSS score is 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

A fix has been implemented in the Linux kernel to use reserved tags for register read/write commands in the nvme-fabrics subsystem. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.