Linux kernel NVMe-oF RDMA target (nvmet, uninitialised completion-entry result field): This is a straight kernel-stack

Impact

This is a straight kernel-stack disclosure to a remote party. The first two dwords of every NVMe completion entry were left uninitialised on the RDMA transport when the command did not define them - TCP and FC zeroed them, RDMA did not - so the target returned leftover kernel stack contents to whichever initiator issued the command. A remote tenant with an NVMe-oF connection harvests kernel stack bytes at whatever rate it can submit commands, which is exactly the primitive you need to defeat KASLR before using one of the corruption bugs above.

Who can reach it

Remote. Any initiator connected over NVMe-oF/RDMA; the leak arrives in the ordinary completion path, no malformed input required.

What to do

Kernel update explicitly initialising cqe.result on the RDMA path. Nothing configurable helps - the leak is in normal, well-formed traffic, which also means it produces no anomalous-traffic signal to detect on.

References