Linux kernel nvme-fc: error recovery iterates an uninitialized IO tagset when admin connect times out

Impact

When an nvme-fc controller in CONNECTING state hits an admin request timeout, ctrl->ioerr_work runs __nvme_fc_abort_outstanding_ios(), which aborts requests in both the admin and IO tagsets. ctrl.queue_count is set early in nvme_fc_alloc_ctrl(), so if fc_ctrl->tag_set was never initialized the code calls blk_mq_tagset_busy_iter() on it anyway - the reported symptom is a lockdep splat during connect failure. The fix checks that the IO tagset was created before iterating busy requests, and cancels ctrl->ioerr_work before removing the IO tagset. The trigger is an FC connectivity loss or a failed admin-queue connect, which is ordinary storage-fabric behaviour rather than something an attacker supplies, so on a GPU node this matters where NVMe-over-FC carries datasets or checkpoints and a fabric flap can destabilize the host. The record shows only the lockdep warning; the surrounding code path touches an uninitialized tagset, so treat the worst case as kernel instability during connect failure rather than as a demonstrated privilege boundary crossing.

Who can reach it

Requires a host using nvme-fc; reached through admin-queue connect timeouts or connectivity loss on the Fibre Channel fabric. No authentication is involved because no login is involved - it is fabric-side conditions, not a user-space entry point. Unprivileged local users cannot reach it.

What to do

Update to a stable kernel with the linked commits and reboot affected hosts; nvme-fc handles boot or dataset storage on these nodes, so a module reload is not a practical substitute. Fold it into the same maintenance window as other FC-NVMe kernel fixes you are carrying. No workaround beyond keeping the FC fabric stable, which is not a security control.

References

Related entries

• Linux kernel qla2xxx: unserialized NVMe-FC unsolicited-context list can be corrupted by concurrent add and deleteCVE-2026-97527 · Linux kernel scsi qla2xxx (fcport->unsol_ctx_head list unserialized across ISR, DPC and NVMe-FC callbacks)High
• Linux kernel qla2xxx: NVMe-FC unsolicited context freed while still linked, leaving a freed node on the listCVE-2026-97528 · Linux kernel scsi qla2xxx (uctx freed without list_del() on qla_nvme_xmt_ls_rsp() error path)High
• Linux KVM x86: per-vCPU MMIO cache uses address space 0, letting a guest force bogus MMIO exitsCVE-2026-99082 · Linux kernel KVM x86 (per-vCPU MMIO cache, SMM address space)High
• Erlang/OTP public_key: unbounded certificate policy tree lets a TLS peer exhaust the BEAM nodeCVE-2026-59251 · Erlang/OTP public_key pubkey_policy_tree (X.509 certificate policy validation)High
• libssh2: malicious SSH server can corrupt the heap of any client opening an SFTP sessionCVE-2026-66032 · libssh2 sftp_open() (src/sftp.c double free)High
• libssh2: pre-auth integer underflow crashes any client that negotiates AES-GCMCVE-2026-66033 · libssh2 ssh2_cipher_crypt() (src/openssl.c AES-GCM length underflow)High