CVE-2026-97409
Received Received - Intake

Race Condition in NVMe-FC Driver Leading to System Warning

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This ends up calling __nvme_fc_abort_outstanding_ios() which aborts requests in both admin and io tagsets. In case fc_ctrl->tag_set was not initialized we see the warning below. This is because ctrl.queue_count is initialized early in nvme_fc_alloc_ctrl(). nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc] Call Trace: <TASK> dump_stack_lvl+0x57/0x80 register_lock_class+0x567/0x580 __lock_acquire+0x330/0xb90 lock_acquire.part.0+0xad/0x210 blk_mq_tagset_busy_iter+0xf9/0xc00 __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc] nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc] process_one_work+0x82c/0x1450 worker_thread+0x5ee/0xfd0 kthread+0x3a0/0x750 ret_from_fork+0x439/0x670 ret_from_fork_asm+0x1a/0x30 </TASK> Update the check in __nvme_fc_abort_outstanding_ios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerr_work before removing io tagset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97409
EUVD
EUVD-2026-86222

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the NVMe over Fibre Channel (NVMe-FC) driver. When a new controller is initializing, an admin request timeout can trigger error recovery before the I/O tagset is fully set up. This causes the system to attempt aborting requests on an uninitialized tagset, leading to a warning or lockdep-related issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's nvme-fc driver and may manifest as warnings or errors related to lockdep or queue initialization failures. Check kernel logs for messages like 'queue 0 connect admin queue failed' or 'trying to register non-static key' using dmesg or journalctl commands.

Impact Analysis

This vulnerability may cause system instability or warnings during NVMe-FC controller initialization. It could lead to connectivity loss between the host and storage device, triggering error recovery processes that disrupt normal operations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for related errors and ensure nvme-fc driver is properly initialized before use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart