Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connect

Impact

When nvme_add_ctrl() fails, nvme_fc_init_ctrl() takes an error exit that skips clearing ctrl->ctrl.opts, so the transport frees the fabrics options and nvmf_create_ctrl() frees them again - a slab use-after-free confirmed by KASAN in the commit message. The failing allocation is dev_set_name(), so the path is reached under memory pressure rather than by a clean attacker-chosen trigger. On a node attached to FC storage this is a kernel-memory corruption during controller connect, which is exactly what happens during a storage flap when the box is already short on memory.

Who can reach it

Local, on a host using NVMe over Fibre Channel. Requires the connect path to fail on an allocation; no network authentication step is described.

What to do

Update to the stable kernel carrying the fix (ownership is derived from rport list membership via a new fail_unlist path) and reboot the node. Only affects hosts with the nvme-fc transport in use. The record names stable commits, not fixed release numbers.

References

Related entries

• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High