CVE-2026-80790

A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could potentially exploit this to cause system instability or a denial of service (DoS), making the system unresponsive.

An invalid free in the nvmet-fc LS IOD allocation error path occurs because nvmet_fc_alloc_ls_iodlist advances the iod pointer while initializing the array and then frees the advanced pointer during unwind. If request buffer allocation or response buffer DMA mapping fails, the unwind path can call kfree on an address outside the allocated object, which is a kernel memory corruption condition. For the CVSS the PR:L is used in the paranoid score because reduced storage administration rights, container root, or delegated target setup may be enough in some deployments, although typical direct target port creation is administrative. The issue is not network reachable by itself and is triggered through local NVMe target setup or fault and resource failure conditions. Impact is at least local denial of service via KASAN report or kernel crash and in worst case may allow confidentiality or integrity impact due to invalid free memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.