CVE-2026-90411nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code only recorded the error and fell through: it left the already-mapped cmd_iu unmapped and still marked the op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call .exit_request() when .init_request() fails, the cmd_iu mapping is leaked for every op whose rsp_iu mapping fails. Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and returns the error without marking the op idle, so it stays in the FCPOP_STATE_UNINIT state set by the initial memset().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e399441de9115cd472b8ace6c517708273ca7997 before c0892cfb60a75e2c86ba8e2127b133f6549c12b3; from e399441de9115cd472b8ace6c517708273ca7997 before 5e820d04c241c81a47e1940349018690e93d8167; from e399441de9115cd472b8ace6c517708273ca7997 before bb0251991420c25e3ceeac40ea09250d79ed7ef0; from e399441de9115cd472b8ace6c517708273ca7997 before acc173608ca7abe5dee8983086b44efd8b0dbc84; from e399441de9115cd472b8ace6c517708273ca7997 before 18c5781ed8bc2f423c26ec93e47e2057cd76a783; from e399441de9115cd472b8ace6c517708273ca7997 before bd764baf82bb46e958a0bd0b481630dd71313055; from e399441de9115cd472b8ace6c517708273ca7997 before be5eb47ee3fea338efae1a5b678d6bb5f0fcc931; from e399441de9115cd472b8ace6c517708273ca7997 before f49d0c3a8d56a7cda1628ae17341a4a42063563c | CNA record |
References
- https://git.kernel.org/stable/c/c0892cfb60a75e2c86ba8e2127b133f6549c12b3
- https://git.kernel.org/stable/c/5e820d04c241c81a47e1940349018690e93d8167
- https://git.kernel.org/stable/c/bb0251991420c25e3ceeac40ea09250d79ed7ef0
- https://git.kernel.org/stable/c/acc173608ca7abe5dee8983086b44efd8b0dbc84
- https://git.kernel.org/stable/c/18c5781ed8bc2f423c26ec93e47e2057cd76a783
- https://git.kernel.org/stable/c/bd764baf82bb46e958a0bd0b481630dd71313055
- https://git.kernel.org/stable/c/be5eb47ee3fea338efae1a5b678d6bb5f0fcc931
- https://git.kernel.org/stable/c/f49d0c3a8d56a7cda1628ae17341a4a42063563c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.