CVE-2026-23376

A flaw was found in the Linux kernel's nvmet-fcloop component. This vulnerability occurs due to incorrect handling of resource freeing when the remote port state is not online. Specifically, the fcloop_t2h_xmt_ls_rsp routine fails to check the remoteport->port_state before calling a done callback, which can lead to improper resource management. This could potentially result in system instability or resource leaks.

This flaw affects systems using NVMe over Fibre Channel loopback (fcloop) for testing. The missing port_state check causes incorrect callback handling when the remote port is not online, leading to resource management issues. This is primarily a testing/development driver issue rather than a production deployment concern.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.