CVE-2026-89514: Linux Kernel Race Condition Vulnerability

CVE-2026-89514 Overview

CVE-2026-89514 affects the Linux kernel's fnic SCSI driver, which supports Cisco FCoE (Fibre Channel over Ethernet) host bus adapters. The function fnic_fcoe_process_vlan_resp() allocates a VLAN descriptor using kzalloc_obj() with the default GFP_KERNEL flag while holding vlans_lock acquired through spin_lock_irqsave(). Because GFP_KERNEL allocations may sleep, invoking them inside an IRQ-safe spinlock violates kernel locking rules. The result is a sleeping-from-invalid-context warning or a potential deadlock on affected systems. The upstream fix replaces the allocation flag with GFP_ATOMIC so memory is obtained without sleeping.

Critical Impact
The defect can trigger kernel warnings and deadlocks on FCoE storage hosts, threatening availability of SCSI I/O paths that depend on the fnic driver.

Affected Products

Linux kernel builds including the scsi: fnic driver prior to the fix
Distributions shipping the vulnerable fnic_fcoe_process_vlan_resp() code path
Systems using Cisco FCoE host bus adapters managed by the fnic driver

Discovery Timeline

2026-09-11 - CVE-2026-89514 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89514

Vulnerability Analysis

The defect is a locking-context violation inside the fnic SCSI driver's FCoE VLAN response handler. When fnic_fcoe_process_vlan_resp() processes a VLAN discovery response, it acquires vlans_lock through spin_lock_irqsave(), disabling interrupts on the local CPU. Within that critical section, the code calls kzalloc_obj() to allocate a VLAN descriptor. The default allocation flag GFP_KERNEL permits the memory subsystem to sleep while reclaiming pages. Sleeping while holding a spinlock is prohibited by the Linux kernel's locking model and produces a scheduling-while-atomic error path.

On kernels built with debug options such as CONFIG_DEBUG_ATOMIC_SLEEP, the driver emits a sleeping-from-invalid-context warning. On production kernels the same call sequence can stall the CPU or deadlock when the allocator blocks awaiting reclaim that itself needs the interrupts the caller has disabled. The remediation swaps GFP_KERNEL for GFP_ATOMIC, which instructs the allocator to fail rather than sleep.

Root Cause

The root cause is improper use of a sleeping memory allocation flag inside an IRQ-safe spinlock critical section. The fnic_fcoe_process_vlan_resp() function did not select an atomic allocation flag appropriate for the surrounding lock context.

Attack Vector

The issue is a reliability and stability defect exercised by normal FCoE VLAN discovery traffic. It is not documented as a remotely exploitable code execution flaw. Impact is limited to systems running the vulnerable fnic driver during FCoE VLAN response processing.

No verified proof-of-concept code is published. See the upstream fixes referenced in the Kernel Git Commit 9639c63, Kernel Git Commit c4ade05, and Kernel Git Commit d86f65a for the exact diff.

Detection Methods for CVE-2026-89514

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context referencing fnic_fcoe_process_vlan_resp.
Soft lockup or hung task warnings on hosts running the fnic driver during FCoE VLAN discovery.
Unexpected FCoE session resets or SCSI I/O stalls correlated with VLAN response processing.

Detection Strategies

Inventory hosts loading the fnic kernel module using lsmod | grep fnic and cross-reference kernel versions against patched builds.
Enable CONFIG_DEBUG_ATOMIC_SLEEP in test environments to surface invalid-context allocations before production deployment.
Monitor dmesg and centralized logging pipelines for scheduling-while-atomic traces referencing SCSI or FCoE stack functions.

Monitoring Recommendations

Forward kernel ring buffer output to a SIEM and alert on sleeping function and scheduling while atomic strings.
Track FCoE session flap counts and SCSI error recovery events on storage-attached hosts.
Establish baseline uptime and I/O latency metrics for fnic-based hosts to detect regressions after the driver processes VLAN responses.

How to Mitigate CVE-2026-89514

Immediate Actions Required

Upgrade to a Linux kernel release that includes the GFP_ATOMIC fix in fnic_fcoe_process_vlan_resp().
Apply distribution vendor kernel updates as soon as they are published for your supported release stream.
Schedule reboots on FCoE storage hosts to activate the patched kernel image.

Patch Information

The upstream fix changes the allocation flag from GFP_KERNEL to GFP_ATOMIC inside fnic_fcoe_process_vlan_resp(). The commits are available at Kernel Git Commit 9639c63, Kernel Git Commit c4ade05, and Kernel Git Commit d86f65a. Consult your distribution advisory for the specific stable release containing the backport.

Workarounds

Unload the fnic driver on hosts that do not require Cisco FCoE connectivity until a patched kernel is deployed.
Reduce VLAN discovery churn by stabilizing FCoE fabric configuration to limit exposure to the affected code path.
Restrict debug kernels with CONFIG_DEBUG_ATOMIC_SLEEP to non-production environments to avoid amplifying warnings into service disruptions.

bash

# Configuration example
# Identify kernel version and confirm fnic module status
uname -r
lsmod | grep fnic

# Temporarily unload the driver where FCoE is not in use
sudo modprobe -r fnic

# Apply vendor kernel update and reboot
sudo dnf update kernel && sudo reboot