Linux kernel fnic: sleeping allocation under an IRQ-safe spinlock during FCoE VLAN discovery

Impact

fnic_fcoe_process_vlan_resp() allocated a VLAN descriptor with GFP_KERNEL while holding vlans_lock via spin_lock_irqsave(), so the allocation could sleep in atomic context. In practice that means a sleeping-from-invalid-context splat and, if the allocator actually blocks, a deadlock on the storage path of the node. On a GPU node this lands on the FCoE HBA used to reach shared storage, so the failure mode is a host that hangs or loses its storage path rather than a clean degradation, and the node has to be drained and rebooted. Only hosts using Cisco VIC adapters with FCoE are affected; the record gives no CVSS score and no evidence of exploitation.

Who can reach it

Reachable from the FCoE fabric the adapter is attached to: VLAN discovery responses processed by the driver. No host authentication is involved, but the sender must be on the FCoE/FIP broadcast domain. Hosts without a Cisco VIC FCoE adapter do not run this code.

What to do

Update to a kernel carrying the GFP_ATOMIC fix (commits linked in the record) and reboot each affected node; there is no runtime mitigation short of not using FCoE on the VIC. On a GPU fleet this is a rolling drain and reboot, and the storage path is in use during boot, so module reload is not a practical substitute.

References

Related entries

• Linux kernel SCSI core: uninitialized kernel heap bytes are DMA'd out as DMA pad on unaligned transfersCVE-2026-89515 · Linux kernel SCSI core (scsi_alloc_sgtables DMA padding)Unscored
• Linux kernel sched_ext: BUG_ON panic when a DSQ is destroyed before a deferred re-enqueue runsCVE-2026-89516 · Linux kernel sched_ext (process_deferred_reenq_users BUG_ON on a destroyed DSQ)Unscored
• Linux kernel sched_ext: core-scheduling pick state corrupted when dispatch drops the rq lockCVE-2026-89517 · Linux kernel sched_ext (rq->core_pick and the keep-previous-task decision under core scheduling)Unscored
• Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rqCVE-2026-89518 · Linux kernel sched_ext dispatch kfuncs (this_rq() vs the dispatched rq under core scheduling)Unscored
• Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flipsCVE-2026-89520 · Linux kernel sched/core (core-scheduling selection vs a pick_task() that releases the rq lock)Unscored
• Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completionCVE-2026-89536 · Linux kernel SUNRPC (client-side TLS handshake, xs_tls_handshake_sync)Unscored