CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nvdimm/btt: Handle preemption in BTT lane acquisition

BTT lanes serialize access to per-lane metadata and workspace state
during BTT I/O. The btt-check unit test reports data mismatches during
BTT writes due to a race in lane acquisition that can lead to silent
data corruption.

The existing lane model uses a spinlock together with a per-CPU
recursion count. That recursion model stopped being valid after BTT
lanes became preemptible: another task can run on the same CPU,
observe a non-zero recursion count, bypass locking, and use the same
lane concurrently.

BTT lanes are also held across arena_write_bytes() calls. That path
reaches nsio_rw_bytes(), which flushes writes with nvdimm_flush().
Some provider flush callbacks can sleep, making a spinlock the wrong
primitive for the lane lifetime.

Replace the spinlock-based recursion model with a dynamically
allocated per-lane mutex array and take the lane lock
unconditionally.

Add might_sleep() to catch any future atomic-context caller.

Found with the ndctl unit test btt-check.sh.

The Linux kernel CVE team has assigned CVE-2026-74365 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.63 with commit f23859748e3d530217b197e146a9ac84faf0a282 and fixed in 6.1.178 with commit fd7a97b2514cfc4b4cc067a27dd39bde2a8b1735
	Issue introduced in 6.6.2 with commit 6f50b414f1a0d790f11a6438a3ad6d0577eb2c18 and fixed in 6.6.145 with commit 73e35c1bdfa160b41fdbe204e02325f0687de506
	Issue introduced in 6.7 with commit 36c75ce3bd299878fd9b238e9803d3817ddafbf3 and fixed in 6.12.97 with commit 417918783bcfe0be135019df16a267b3af442efd
	Issue introduced in 6.7 with commit 36c75ce3bd299878fd9b238e9803d3817ddafbf3 and fixed in 6.18.40 with commit 5c53406098b599c420b031e6ec5ba8a2f3794c50
	Issue introduced in 6.7 with commit 36c75ce3bd299878fd9b238e9803d3817ddafbf3 and fixed in 7.1.5 with commit 4eafa810b042d985ec6bbf5b514414e73cee6f6f
	Issue introduced in 6.7 with commit 36c75ce3bd299878fd9b238e9803d3817ddafbf3 and fixed in 7.2-rc1 with commit 8d4b989d9c9afe5f185aa5853b666fc4617afe9e
	Issue introduced in 4.19.299 with commit 2577fece583c7c05cda7ad50dde7638c962665e1
	Issue introduced in 5.4.261 with commit 40ba3fa21250e361bdd8f00800b3e2cb6160de95
	Issue introduced in 5.10.201 with commit b0e7a935739f33ed2bd6868b89f97dd4c2683c26
	Issue introduced in 5.15.139 with commit 66eb7b7f23dd9aec5356e7054dd3596ae7648ff5
	Issue introduced in 6.5.12 with commit b27751fb1f271bbb78d5993c0b10011628e40e18

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74365
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	Documentation/driver-api/nvdimm/btt.rst
	drivers/nvdimm/nd.h
	drivers/nvdimm/region_devs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fd7a97b2514cfc4b4cc067a27dd39bde2a8b1735
	https://git.kernel.org/stable/c/73e35c1bdfa160b41fdbe204e02325f0687de506
	https://git.kernel.org/stable/c/417918783bcfe0be135019df16a267b3af442efd
	https://git.kernel.org/stable/c/5c53406098b599c420b031e6ec5ba8a2f3794c50
	https://git.kernel.org/stable/c/4eafa810b042d985ec6bbf5b514414e73cee6f6f
	https://git.kernel.org/stable/c/8d4b989d9c9afe5f185aa5853b666fc4617afe9e