Executive brief
The Linux kernel's NVMe-FC driver has a memory management flaw that can cause the same data structure to be freed twice when certain initialization operations fail. An attacker or system under memory pressure could trigger this condition, leading to potential crashes or system instability. This affects systems using NVMe-FC storage connectivity.
Technical details
The vulnerability is a double-free in nvme-fc's initialization path caused by incomplete error handling after commit 1a9e218195a5. When nvme_add_ctrl() fails (reachable via memory pressure or fault injection during dev_set_name()), the error path bypasses the "ctrl->ctrl.opts = NULL" assignment that normally prevents double-free. As a result, nvme_fc_ctrl_free() and nvmf_create_ctrl() both attempt to free the fabrics options. The fix restructures error handling by introducing a fail_unlist label and deriving ownership from list membership (controller presence on rport->ctrl_list), matching the pattern used in nvme-tcp, nvme-rdma, and nvme-loop. The ctrl->ctrl.opts pointer remains valid throughout teardown, eliminating fragility in AUTH and sysfs attribute handling.
Affected products
- Linux Linux Kernel 5.15 and later versions prior to the fix
Timeline
- 2026-09-16: disclosed: CVE-2026-89974 publicly disclosed