CVE-2026-89514

Received Received - Intake

Memory Allocation Flaw in Linux Kernel fnic Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock fnic_fcoe_process_vlan_resp() allocates a VLAN descriptor with kzalloc_obj() (default GFP_KERNEL) while holding vlans_lock via spin_lock_irqsave(). GFP_KERNEL may sleep, which is not allowed in this atomic context and can trigger a sleeping-from-invalid-context warning or deadlock. Pass GFP_ATOMIC so the allocation is safe under the IRQ-safe spinlock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89514

EUVD

EUVD-2026-76420

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's fnic driver, which handles Fibre Channel over Ethernet (FCoE). The issue occurs when allocating memory for a VLAN descriptor while holding a spinlock. The code uses GFP_KERNEL which can sleep, but spinlocks require non-sleeping allocations. This mismatch can cause system warnings or deadlocks.

Detection Guidance

This vulnerability may trigger kernel warnings or deadlocks when VLAN allocation fails under spinlock in the fnic driver. Check kernel logs for messages like sleeping-from-invalid-context warnings or fnic-related errors using dmesg or journalctl.

Impact Analysis

This vulnerability could cause system instability, including kernel warnings or deadlocks, leading to crashes or unresponsiveness. It primarily affects systems using the fnic driver for FCoE operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue related to improper memory allocation in a spinlock context, which could lead to system instability or crashes but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-89514. If immediate patching is not possible, avoid heavy network load on systems using the fnic driver to reduce the risk of triggering the issue.

Hi! I’m here to help you understand CVE-2026-89514. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70