The vulnerability in the Linux kernel's nvmet-tcp module involves a race condition between handling Initialization Connection Requests (ICReq) and the teardown of the target-side queue. Specifically, nvmet_tcp_handle_icreq() updates the queue state without proper serialization against queue teardown, allowing the queue state to be overwritten after it has been marked as disconnecting. This can lead to a second reference release on an already released queue, causing memory corruption or kernel crashes. The flaw also affects the ICResp send failure path, where a send error can reopen the teardown window. The fix involves serializing state transitions with a lock and aborting state changes if teardown has started, using an internal sentinel error code to manage the process.

Successful exploitation can cause kernel memory corruption or crashes due to double release of queue references, leading to denial of service or potential system instability. The vulnerability affects the NVMe/TCP target implementation in the Linux kernel, impacting systems that use this feature for storage networking.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. The vendor advisory does not indicate that no action is required or that the issue is already mitigated.