A recursive lock acquisition occurs in the Linux kernel nvmet module when the controller is freed while its async event work is still scheduled on the nvmet workqueue. The flush_work call inside nvmet_ctrl_free() executes while the same workqueue lock is already held, causing a deadlock detected by lockdep. If the deadlock resolves, it can block the worker thread indefinitely, leading to a kernel lockup or a delayed termination of the nvmet service, which effectively denies functionality to clients relying on NVMe over Fabrics. This vulnerability does not directly provide an attacker with code execution or data exfiltration; the primary impact is a loss of service availability for NVMe traffic. This is a concurrency bug (CWE‑833).

The vulnerability affects the Linux kernel, specifically versions 5.18 and all 7.0 release candidates from RC1 through RC7. Any system running these kernel releases with nvmet enabled is potentially impacted. The issue arises with both the standard kernel and the development 7.0 series that include the nvmet module.

The CVSS score of 7.5 indicates moderate-to-high severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The bug has not been listed in the CISA KEV catalog, further supporting that it is not actively exploited. The most likely attack vector is local or privileged; a malicious user who can generate or force an nvmet disconnect may trigger the recursive locking scenario. Because the flaw surfaces during normal kernel operation of NVMe connections and requires the kernel to execute a flush while holding its own workqueue lock, remediation focuses on applying the kernel patch that moves async event work to a dedicated queue.