Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connect

Impact

When nvme_add_ctrl() fails, nvme_fc_init_ctrl() takes an error exit that skips clearing ctrl->ctrl.opts, so the transport frees the fabrics options and nvmf_create_ctrl() frees them again - a slab use-after-free confirmed by KASAN in the commit message. The failing allocation is dev_set_name(), so the path is reached under memory pressure rather than by a clean attacker-chosen trigger. On a node attached to FC storage this is a kernel-memory corruption during controller connect, which is exactly what happens during a storage flap when the box is already short on memory.

Who can reach it

Local, on a host using NVMe over Fibre Channel. Requires the connect path to fail on an allocation; no network authentication step is described.

What to do

Update to the stable kernel carrying the fix (ownership is derived from rport list membership via a new fail_unlist path) and reboot the node. Only affects hosts with the nvme-fc transport in use. The record names stable commits, not fixed release numbers.

References

Related entries

• Linux kernel NFSv4 client: dropped delegations leave the state manager looping on revoked stateCVE-2026-90234 · Linux kernel NFSv4 client (delegation handling in nfs_inode_set_delegation)High
• Linux qla2xxx: dying NPIV vport re-inserted into host_map during report ID acquisition, causing use-after-freeCVE-2026-97531 · Linux kernel scsi/qla2xxx (report ID acquisition vs. vport deletion)High
• Linux qla2xxx: pending qpair work runs after response queue teardown, causing use-after-freeCVE-2026-97536 · Linux kernel scsi/qla2xxx (queue pair teardown, qla25xx_free_rsp_que)High
• Linux nvme: sparse NSID gaps make namespace scan iterate billions of times, causing soft lockupCVE-2026-98056 · Linux kernel nvme core (nvme_scan_ns_list stale-namespace removal)High
• Linux kernel libiscsi_tcp: a Data-In PDU naming a WRITE command's ITT overwrites the writer's own pagesCVE-2026-98479 · Linux kernel libiscsi_tcp (Data-In PDU direction check in iscsi_tcp_hdr_dissect)High
• Linux kernel nvmet: metadata SGL allocation failure frees the data SGL against an unassigned p2p deviceCVE-2026-98964 · Linux kernel nvmet (P2P device handling in nvmet_req_alloc_p2pmem_sgls error path)High