nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

Summary

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.

Timeline

1. Nov 12, 2025, 10:46 AM UTCCVE published
2. Oct 15, 2026, 9:57 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 15, 2026, 10:02 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 5e0bc09a52b6169ce90f7ac6e195791adb16cec4 · fixed in 11269c08013f4ee8b8f5edc6c56700acb34092d0; From 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 · fixed in a28112cc55013cd8cbd5d36b5115a5b851151bd9; From eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 · fixed in 060ecc81240ef9d60d9485a3a5eb55a0d6e7a25c; From 710c69dbaccdac312e32931abcb8499c1525d397 · fixed in 7331925c247b03b7767b8cd93cfe1b7aa2377850; From 710c69dbaccdac312e32931abcb8499c1525d397 · fixed in 7a619f8c869117ffed08365b377f66b7e1d941b4; From 710c69dbaccdac312e32931abcb8499c1525d397 · fixed in db5a5406fb7e5337a074385c7a3e53c77f2c1bd3; From 5.15.150 · fixed in 5.15.195; From 6.1.80 · fixed in 6.1.156; From 6.6.19 · fixed in 6.6.112; From 6.7.7 · fixed in 6.8

• Linux Linux

  6.8

• KernelLinux

  fixed in 5.15.195; From 5.16.0 · fixed in 6.1.156; From 6.2.0 · fixed in 6.6.112; From 6.7.0 · fixed in 6.12.53; From 6.8.0 · fixed in 6.17.3

References 6