On Thu, Feb 20, 2025 at 01:18:30PM +0200, Sagi Grimberg wrote: > nvme_tcp_poll() may race with the send path error handler because > it may complete the request while it is actively being polled for > completion, resulting in a UAF panic [1]: Thanks, applied to nvme-6.14.