A recursive lock acquisition occurs in the Linux kernel NVMe Target (nvmet) module when a controller is freed while its async event work is still scheduled on the nvmet workqueue. The flush_work call inside nvmet_ctrl_free() attempts to acquire the same workqueue lock that the worker thread already holds, causing a lockdep recursion warning and potentially a deadlock. If the deadlock resolves, the worker thread can block indefinitely, resulting in a kernel lockup or a delayed termination of the nvmet service, which effectively denies service to clients using NVMe over Fabrics. This is a concurrent state corruption issue (CWE‑833) that does not provide code execution or data exfiltration. The vulnerability is exercised through normal operation of NVMe connections; any action that triggers a controller disconnect while the async event work is pending can expose the flaw, leading to a loss of availability for NVMe traffic. Because the bug is confined to kernel internal state and requires the attacker to trigger a disconnect on an NVMe target, it is not an arbitrary code execution vector but a denial‑of‑service vector.

The issue affects the Linux kernel across multiple releases. Known impacted versions include the stable kernel 5.18 and the development 7.0 line through release candidates RC1 to RC7. Any system running these kernel releases with the nvmet module enabled or with NVMe over Fabrics traffic could be affected, regardless of distribution. Both mainstream and experimental builds incorporating the kernel are susceptible.

The CVSS score of 7.5 indicates a moderate-to‑high severity. The EPSS score of less than 1% indicates that the likelihood of exploitation in the wild is very low. The vulnerability is not listed in the CISA KEV catalog, further supporting that it is not actively exploited. The most likely attack vector is local or privileged; a malicious user who can trigger an NVMe disconnect may induce the recursive lock scenario. Because the flaw surfaces during legitimate kernel operation of NVMe connections and requires a flush during lock ownership, remediation focuses on applying the patch that moves async event work to a dedicated queue.