UBUNTU-CVE-2026-97409: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerrwork to abort inflight requests. This ends up calling nvmefcabortoutstandingios() which aborts requests in both admin and io tagsets. In case fcctrl->tagset was not initialized we see the warning below. This is because ctrl.queuecount is initialized early in nvmefcallocctrl(). nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvmefcctrlioerrwork [nvmefc] Call Trace: <TASK> dumpstacklvl+0x57/0x80 registerlockclass+0x567/0x580 lockacquire+0x330/0xb90 lockacquire.part.0+0xad/0x210 blkmqtagsetbusyiter+0xf9/0xc00 nvmefcabortoutstandingios+0x23f/0x320 [nvmefc] nvmefcctrlioerrwork+0x172/0x210 [nvmefc] processonework+0x82c/0x1450 workerthread+0x5ee/0xfd0 kthread+0x3a0/0x750 retfromfork+0x439/0x670 retfromforkasm+0x1a/0x30 </TASK> Update the check in nvmefcabortoutstandingios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerrwork before removing io tagset.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In nvme-fc, cancel ctrl->ioerr_work before removing the io tagset, and update __nvme_fc_abort_outstanding_ios() to verify that the io tagset was created before iterating over busy requests.