Executive brief
The Linux kernel's NVMe Fibre Channel target driver contains a memory management bug in error handling. During initialization of NVMe-FC link service I/O descriptors, if memory allocation fails, the code frees an incorrect memory address, which can cause kernel crashes and data corruption. This affects systems using NVMe-FC storage targets.
Technical details
The vulnerability is a use-after-free / invalid-free (CWE-590) in the nvmet_fc_alloc_ls_iodlist() function in drivers/nvme/target/fc.c. The code advances a pointer (iod) while initializing an array of I/O descriptors. If an rqstbuf allocation or response buffer DMA mapping fails, the error handling loop decrements the pointer past the start of the allocated array, causing kfree(iod) to free an address before the actual allocated object. This is detected by KASAN as invalid-free. The fix is to free the original allocation base stored in tgtport->iod instead of the incremented pointer. The vulnerability can be triggered via failslab injection (setting fail-nth=6 before creating a target port). No authentication or network interaction required for exploitation on affected systems running NVMe-FC targets.
Affected products
- Linux Linux Kernel Linux 4.x through 6.x (nvme-fc driver)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Upstream fix commit ba98d6796d12258e837ece065d2ecb59d76ce4ff