{"id":28656,"date":"2026-09-25T04:31:32","date_gmt":"2026-09-24T20:31:32","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97409"},"modified":"2026-09-25T04:31:32","modified_gmt":"2026-09-24T20:31:32","slug":"cve-2026-97409","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97409","title":{"rendered":"CVE-2026-97409 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: Do not cance"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nvme-fc: Do not cancel requests in io target before it is initialized<\/p>\n<p>A new nvme-fc controller in CONNECTING state sees admin request timeout<br \/>\nschedules ctrl-&gt;ioerr_work to abort inflight requests. This ends up<br \/>\ncalling __nvme_fc_abort_outstanding_ios() which aborts requests in both<br \/>\nadmin and io tagsets. In case fc_ctrl-&gt;tag_set was not initialized we<br \/>\nsee the warning below. This is because ctrl.queue_count is initialized<br \/>\nearly in nvme_fc_alloc_ctrl().<\/p>\n<p>nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss<br \/>\nINFO: trying to register non-static key.<br \/>\nThe code is fine but needs lockdep annotation, or maybe<br \/>\nlpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6).<br \/>\nyou didn&#8217;t initialize this object before use?<br \/>\nturning off the locking correctness validator.<br \/>\nWorkqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc]<br \/>\nCall Trace:<\/p>\n<p> dump_stack_lvl+0x57\/0x80<br \/>\n register_lock_class+0x567\/0x580<br \/>\n __lock_acquire+0x330\/0xb90<br \/>\n lock_acquire.part.0+0xad\/0x210<br \/>\n blk_mq_tagset_busy_iter+0xf9\/0xc00<br \/>\n __nvme_fc_abort_outstanding_ios+0x23f\/0x320 [nvme_fc]<br \/>\n nvme_fc_ctrl_ioerr_work+0x172\/0x210 [nvme_fc]<br \/>\n process_one_work+0x82c\/0x1450<br \/>\n worker_thread+0x5ee\/0xfd0<br \/>\n kthread+0x3a0\/0x750<br \/>\n ret_from_fork+0x439\/0x670<br \/>\n ret_from_fork_asm+0x1a\/0x30<\/p>\n<p>Update the check in __nvme_fc_abort_outstanding_ios() confirm that io<br \/>\ntagset was created before iterating over busy requests. Also make sure<br \/>\nto cancel ctrl-&gt;ioerr_work before removing io tagset.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nvme-fc: Do not cancel requests in io target before it is initialized<\/p>\n<p>A new nvme-fc controller in CONNECTING state sees admin requ<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28656","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}