CVE-2026-89974

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails

nvmf_create_ctrl() owns the fabrics options and frees them whenever

->create_ctrl() returns an error, so a transport must not free them on

its own error paths. nvme-fc tracks this by testing ctrl->ctrl.opts in

nvme_fc_ctrl_free(), which requires nvme_fc_init_ctrl() to clear that

pointer on every error exit.

The coupling is implicit, and commit 1a9e218195a5 ("nvme: split device

add from initialization") broke it by adding a second error exit. When

nvme_add_ctrl() fails, nvme_fc_init_ctrl() jumps to out_put_ctrl:, past

the "ctrl->ctrl.opts = NULL" that only sits on the fail_ctrl: path, so

nvme_fc_ctrl_free() frees the options and nvmf_create_ctrl() frees them

a second time:

BUG: KASAN: slab-use-after-free in nvmf_free_options+0x30/0x190

nvmf_free_options+0x30/0x190 drivers/nvme/host/fabrics.c:1284

nvmf_create_ctrl drivers/nvme/host/fabri

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References