nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 6 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code only recorded the error and fell through: it left the already-mapped cmd_iu unmapped and still marked the op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call .exit_request() when .init_request() fails, the cmd_iu mapping is leaked for every op whose rsp_iu mapping fails. Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and returns the error without marking the op idle, so it stays in the FCPOP_STATE_UNINIT state set by the initial memset().
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA Linux (Linux) Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, 7.3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-90411
- 2026-10-03 Alias added: GHSA-cp4g-4cx8-r2fq
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-06 CVSS score added · Red Hat
- 2026-10-19 Fix available: Linux/[email protected] · CNA
- 2026-11-07 Affected versions changed · Red Hat
References
Other 8
- https://git.kernel.org/stable/c/c0892cfb60a75e2c86ba8e2127b133f6549c12b3
- https://git.kernel.org/stable/c/5e820d04c241c81a47e1940349018690e93d8167
- https://git.kernel.org/stable/c/bb0251991420c25e3ceeac40ea09250d79ed7ef0
- https://git.kernel.org/stable/c/acc173608ca7abe5dee8983086b44efd8b0dbc84
- https://git.kernel.org/stable/c/18c5781ed8bc2f423c26ec93e47e2057cd76a783
- https://git.kernel.org/stable/c/bd764baf82bb46e958a0bd0b481630dd71313055
- https://git.kernel.org/stable/c/be5eb47ee3fea338efae1a5b678d6bb5f0fcc931
- https://git.kernel.org/stable/c/f49d0c3a8d56a7cda1628ae17341a4a42063563c
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-90411 · CVE Program
- CVE-2026-90411 · NVD
- FIRST EPSS
- GHSA-cp4g-4cx8-r2fq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-90411 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences