CVE-2026-89974 Overview
CVE-2026-89974 is a double free vulnerability in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport driver. The flaw resides in nvme_fc_init_ctrl(), where an error path introduced by commit 1a9e218195a5 ("nvme: split device add from initialization") fails to clear ctrl->ctrl.opts before jumping to out_put_ctrl:. When nvme_add_ctrl() fails, nvme_fc_ctrl_free() frees the fabrics options, and nvmf_create_ctrl() then frees them again, producing a slab use-after-free reported by KASAN.
Critical Impact
Kernel memory corruption via double free of fabrics options can trigger a slab use-after-free, leading to denial of service or potential local privilege escalation on hosts using NVMe-FC.
Affected Products
- Linux kernel versions containing commit 1a9e218195a5 in the nvme-fc transport driver
- Systems using NVMe over Fibre Channel (drivers/nvme/host/fc.c) transport
- Stable kernel branches prior to fix commits 56e6279, 5f89d68, 7df913a, and 8bd14aa
Discovery Timeline
- 2026-09-16 - CVE-2026-89974 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89974
Vulnerability Analysis
The vulnerability is a double free [CWE-415] affecting the NVMe fabric options structure. In the NVMe fabrics model, nvmf_create_ctrl() owns the options passed to a transport's ->create_ctrl() callback and frees them on any error return. Transports must therefore avoid freeing the options themselves on their own error paths.
The nvme-fc driver tracked ownership implicitly by testing ctrl->ctrl.opts in nvme_fc_ctrl_free(). This required nvme_fc_init_ctrl() to clear the pointer on every error exit. The coupling was fragile and broke when a second error exit was added.
Root Cause
Commit 1a9e218195a5 ("nvme: split device add from initialization") introduced a new error label out_put_ctrl: that bypasses the ctrl->ctrl.opts = NULL assignment on the existing fail_ctrl: path. When nvme_add_ctrl() fails, execution jumps past the pointer clear, leaving ctrl->ctrl.opts populated. nvme_fc_ctrl_free() then frees the options, after which nvmf_create_ctrl() frees them a second time in nvmf_free_options().
Attack Vector
Triggering the bug requires nvme_add_ctrl() to fail, which happens when dev_set_name() cannot allocate memory. This makes the flaw reachable under memory pressure or with fault injection on a host performing an NVMe-FC connect operation. A local user with the ability to initiate NVMe-FC controller creation on an adjacent Fibre Channel network can drive the failure path. Without KASAN protection, the double free corrupts slab metadata and can result in kernel panic or memory corruption suitable for further exploitation.
The upstream fix removes the implicit ctrl->opts sentinel and instead derives ownership from rport->ctrl_list membership, matching the pattern used by nvme-tcp, nvme-rdma, and nvme-loop. A new fail_unlist: label ensures the controller is only removed from the list on error paths that ran after insertion.
Detection Methods for CVE-2026-89974
Indicators of Compromise
- KASAN reports citing slab-use-after-free in nvmf_free_options+0x30/0x190 in kernel logs
- Kernel panics or general protection fault traces referencing nvme_fc_ctrl_free or nvmf_create_ctrl in drivers/nvme/host/fc.c and fabrics.c
- Repeated failed NVMe-FC connect attempts correlating with low-memory conditions or fault injection activity
Detection Strategies
- Inventory Linux hosts running vulnerable kernels with the nvme_fc module loaded using package management and lsmod telemetry
- Correlate dmesg output for KASAN or SLUB debug messages naming nvmf_free_options with NVMe-FC connect events
- Monitor for unexpected nvme controller create failures returning -ENOMEM on Fibre Channel hosts
Monitoring Recommendations
- Ingest kernel ring buffer and journald logs into a centralized data lake and alert on KASAN, BUG:, and slab-use-after-free strings
- Track NVMe subsystem events via udev and nvme-cli audit logs to identify anomalous controller lifecycle activity
- Establish baselines for NVMe-FC connect success rates and alert on spikes in nvme_add_ctrl() failures
How to Mitigate CVE-2026-89974
Immediate Actions Required
- Apply the upstream Linux kernel fixes referenced by commits 56e6279, 5f89d68, 7df913a, and 8bd14aa as soon as vendor-signed builds are available
- Prioritize patching Fibre Channel storage hosts and NVMe-oF initiators that mount production LUNs
- Restrict local access on NVMe-FC hosts so that untrusted users cannot trigger controller creation under adversarial memory pressure
Patch Information
The fix is delivered by four stable-tree commits: Linux Kernel Commit 56e6279, Linux Kernel Commit 5f89d68, Linux Kernel Commit 7df913a, and Linux Kernel Commit 8bd14aa. The patch reworks nvme_fc_init_ctrl() to add a fail_unlist: label and derives options ownership from rport->ctrl_list membership sampled under rport->lock. Consumers should track their distribution's backport advisories for RHEL, SUSE, Ubuntu, and Debian kernel packages.
Workarounds
- Unload the nvme_fc module on hosts that do not require NVMe over Fibre Channel using modprobe -r nvme_fc
- Blacklist nvme_fc in /etc/modprobe.d/ on systems that use only iSCSI, FC-SCSI, or NVMe-TCP transports
- Disable kernel fault injection interfaces and enforce memory cgroup limits to reduce the likelihood of hitting the failing allocation path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.