CVE-2026-97409

HighCVSS 8.8

Published: 24/09/2026(UTC)Updated: 03/10/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

In the Linux kernel, a bug was fixed in the nvme-fc driver where an NVMe-FC controller in CONNECTING state could abort I/O requests before the I/O tagset was initialized. This led to a lockdep warning about improper lock usage and potential stability issues during error recovery after connectivity loss.

Risk Assessment

May cause kernel warnings, instability, or system crashes during NVMe over Fibre Channel controller initialization, affecting storage availability in SAN environments.

Recommendation

Update the Linux kernel to a version containing the fix that verifies the I/O tagset is initialized before aborting requests and cancels ioerr_work before removing the I/O tagset.

Other vulnerabilities in Linux kernel nvme-fc

CVE-2026-90411Low risk· EPSS 11%
In the Linux kernel, __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code leaves the already-mapped cmd_iu unmapped and marks the op as FCPOP_STATE_IDLE, leaking the cmd_iu mapping for every failed op. The fix jumps to an error path that unmaps cmd_iu and leaves the op in FCPOP_STATE_UNINIT.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This ends up calling __nvme_fc_abort_outstanding_ios() which aborts requests in both admin and io tagsets. In case fc_ctrl->tag_set was not initialized we see the warning below. This is because ctrl.queue_count is initialized early in nvme_fc_alloc_ctrl(). nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc] Call Trace: <TASK> dump_stack_lvl+0x57/0x80 register_lock_class+0x567/0x580 __lock_acquire+0x330/0xb90 lock_acquire.part.0+0xad/0x210 blk_mq_tagset_busy_iter+0xf9/0xc00 __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc] nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc] process_one_work+0x82c/0x1450 worker_thread+0x5ee/0xfd0 kthread+0x3a0/0x750 ret_from_fork+0x439/0x670 ret_from_fork_asm+0x1a/0x30 </TASK> Update the check in __nvme_fc_abort_outstanding_ios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerr_work before removing io tagset.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS