CVE-2026-23376: Linux Kernel nvmet-fcloop DoS Vulnerability

CVE-2026-23376 Overview

A vulnerability has been identified in the Linux kernel's NVMe over Fibre Channel (nvmet-fcloop) loopback driver. The flaw exists in the fcloop_t2h_xmt_ls_rsp routine, which fails to properly check the remoteport->port_state before invoking the lsrsp->done callback. This can lead to improper resource handling when the remote port is not in the FC_OBJSTATE_ONLINE state.

Critical Impact

Improper callback invocation in the nvmet-fcloop driver may result in resource management issues, potentially causing system instability or denial of service conditions in systems utilizing NVMe-oF with Fibre Channel transport.

Affected Products

• Linux kernel with nvmet-fcloop module enabled
• Systems utilizing NVMe over Fibre Channel loopback functionality
• Enterprise storage systems with FC-NVMe configurations

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23376 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23376

Vulnerability Analysis

The vulnerability resides in the NVMe-FC transport layer's loopback driver (nvmet-fcloop). In the nvme_fc_handle_ls_rqst_work function, the lsrsp->done callback is conditionally set only when remoteport->port_state equals FC_OBJSTATE_ONLINE. When the remote port is in any other state, the NVMe-FC transport layer expects the Low-Level Device Driver (LLDD) call to lport->ops->xmt_ls_rsp to fail, at which point the transport layer handles resource cleanup directly via nvme_fc_xmt_ls_rsp_free rather than relying on the LLDD's done callback.

The fcloop_t2h_xmt_ls_rsp routine did not implement this state check, potentially leading to scenarios where the done callback is invoked inappropriately or resources are not properly freed.

Root Cause

The root cause is a missing state validation check in the fcloop_t2h_xmt_ls_rsp function. The function should verify that remoteport->port_state is FC_OBJSTATE_ONLINE before proceeding with callback-based resource management. Without this check, the code path does not properly signal the NVMe-FC transport layer to handle resource cleanup when the remote port is offline.

Attack Vector

This vulnerability is a kernel-level resource management flaw. Exploitation would require:

1. Access to a system with the nvmet-fcloop kernel module loaded
2. The ability to trigger NVMe-FC link state operations that cause the remote port to transition out of the online state
3. Timing the LS (Link Service) response transmission during the port state transition

The fix updates fcloop_t2h_xmt_ls_rsp to check remoteport->port_state. When the port is online, the lsrsp->done callback handles resource cleanup. When the port is not online, the function returns -ENODEV to signal the NVMe-FC transport layer to directly free the lsrsp resources.

Detection Methods for CVE-2026-23376

Indicators of Compromise

• Kernel log messages related to nvmet-fcloop resource management errors
• System crashes or kernel panics in NVMe-FC subsystem functions
• Unexpected behavior during FC link state transitions in NVMe-oF environments

Detection Strategies

• Monitor kernel logs for warnings or errors originating from the nvmet-fcloop module
• Implement kernel module auditing to track loading of vulnerable nvmet-fcloop versions
• Deploy system stability monitoring on storage nodes using NVMe-FC transport

Monitoring Recommendations

• Enable kernel tracing for NVMe-FC transport layer functions
• Configure alerting for unexpected nvmet-fcloop module behavior
• Review FC port state change events in storage infrastructure logs

How to Mitigate CVE-2026-23376

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• Review systems using NVMe over Fibre Channel loopback configurations
• Consider temporarily disabling the nvmet-fcloop module if not required for operations

Patch Information

The fix has been committed to the Linux kernel stable branches. The patch updates the fcloop_t2h_xmt_ls_rsp routine to properly check remoteport->port_state before invoking the done callback, returning -ENODEV when the port is not online.

Relevant kernel commits:

• Kernel Git Commit 31d3817bc
• Kernel Git Commit dd677d0598
• Kernel Git Commit f30b95159a

Workarounds

• If the nvmet-fcloop module is not required, it can be blacklisted to prevent loading
• Limit access to systems that can trigger FC port state changes
• Implement network segmentation for storage infrastructure utilizing NVMe-oF

# Blacklist nvmet-fcloop module if not required
echo "blacklist nvmet_fcloop" >> /etc/modprobe.d/blacklist.conf
# Unload the module if currently loaded
modprobe -r nvmet_fcloop