nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free is a kernel concurrency bug that can cause recursive flushing of workqueue tasks, leading to a lockdep warning and potentially a deadlock that disrupts normal operation. The flaw occurs when the NVMe over TCP subsystem releases a controller reference while the async_event_work is still queued on the same workqueue. The recursion triggers a second flush of async_event_work, which the workqueue identifies as an illegal recursive lock. This can stall kernel threads, degrade performance, and in worst case cause a system hang. The vulnerability does not allow code execution or privilege escalation, but it can degrade availability.

The issue is confined to the Linux kernel's nvmet subsystem, and it affects any kernel build that includes nvmet with the workqueue implementation described. The logs reference a kernel 7.0.0‑rc3 instance; the bug could be present in earlier stable releases where the same code paths exist. All systems running a Linux kernel that implements nvmet over TCP are potentially vulnerable until the patch that removes the recursive flush is applied.

The CVSS score is not provided, and EPSS data is unavailable, but the lack of a KEV listing suggests no current active exploitation. The bug requires triggering a controller release during an async event, which likely needs a privileged or service-level action that initiates NVMe sessions. An attacker who can send crafted NVMe commands could potentially cause the race, but a successful exploitation would most likely result in a service denial rather than arbitrary code execution. The combination of a moderate severity impact (service interruption) and the low likelihood of exploitation means the risk is low to moderate, but kernel maintainers still recommend applying the fix promptly to avoid lockdep warnings and potential hangs.