CVE-2026-97409nvme-fc: Do not cancel requests in io target before it is initialized
- 8.8HighCVSS base score
- 0.25%Exploitation in 30 daysEPSS · top 83% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This ends up calling __nvme_fc_abort_outstanding_ios() which aborts requests in both admin and io tagsets. In case fc_ctrl->tag_set was not initialized we see the warning below. This is because ctrl.queue_count is initialized early in nvme_fc_alloc_ctrl(). nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc] Call Trace: <TASK> dump_stack_lvl+0x57/0x80 register_lock_class+0x567/0x580 __lock_acquire+0x330/0xb90 lock_acquire.part.0+0xad/0x210 blk_mq_tagset_busy_iter+0xf9/0xc00 __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc] nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc] process_one_work+0x82c/0x1450 worker_thread+0x5ee/0xfd0 kthread+0x3a0/0x750 ret_from_fork+0x439/0x670 ret_from_fork_asm+0x1a/0x30 </TASK> Update the check in __nvme_fc_abort_outstanding_ios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerr_work before removing io tagset.
Timeline
ID reserved
By Linux
Published
- 36 days later
· 36 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.25% · top 83% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 52793d62a696e9188092eb0817fb1219ee5729ff – < 0b7c8009b3037722103032c336732d63e0507a51
- affected 52793d62a696e9188092eb0817fb1219ee5729ff – < 5488e2706c58444a24e15773237dcc0bedcd771f
- affected 52793d62a696e9188092eb0817fb1219ee5729ff – < da930308b4bc24c335574e85ca84ff70a988cf05
- affected 52793d62a696e9188092eb0817fb1219ee5729ff – < dd39064d2948b14dbe4f364fe4b3c9cfc632cc21
- affected 52793d62a696e9188092eb0817fb1219ee5729ff – < ee38469f88492df99e1d97f03aa40ecfd218934f
- affected 5.10
- unaffected < 5.10
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2 – ≤ *
References
References5
- https://git.kernel.org/stable/c/0b7c8009b3037722103032c336732d63e0507a51 (opens in a new tab)
- https://git.kernel.org/stable/c/5488e2706c58444a24e15773237dcc0bedcd771f (opens in a new tab)
- https://git.kernel.org/stable/c/da930308b4bc24c335574e85ca84ff70a988cf05 (opens in a new tab)
- https://git.kernel.org/stable/c/dd39064d2948b14dbe4f364fe4b3c9cfc632cc21 (opens in a new tab)
- https://git.kernel.org/stable/c/ee38469f88492df99e1d97f03aa40ecfd218934f (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86222 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-97409)Record last updated .