CVE-2026-89514

A flaw was found in the Linux kernel's Fibre Channel over Ethernet Network Interface Card (fnic) driver. The fnic_fcoe_process_vlan_resp() function attempts to allocate memory in a way that can cause the system to sleep while holding a spinlock. This incorrect memory allocation in an atomic context can lead to a system deadlock, rendering the system unresponsive. This issue can be triggered by processing VLAN responses.

A moderate-impact flaw was found in the Linux kernel Fibre Channel over Ethernet (FCoE) Network Interface Card (fnic) driver shipped in Red Hat Enterprise Linux and used in Red Hat OpenShift Container Platform. The fnic_fcoe_process_vlan_resp() function allocates a VLAN descriptor with GFP_KERNEL memory, which is permitted to sleep, while holding the vlans_lock spinlock acquired with spin_lock_irqsave(). Performing a sleeping allocation in this atomic context, which is reachable when processing FCoE VLAN responses, can trigger a sleeping-from-invalid-context warning or deadlock the system, rendering it unresponsive. Only availability is impacted; there is no impact to confidentiality or integrity, and Red Hat rated the flaw Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 9 and the OpenShift Container Platform 4.16, 4.17, 4.18, 4.22, 5.0, and 5.1 releases that ship a RHEL 9 based CoreOS kernel are affected; these affected streams are resolved as DEFER because the flaw is Moderate impact with a CVSS score below the 7.0 threshold at which Red Hat files trackers for this product, leaving a residual risk of a local denial of service through system deadlock on systems using fnic FCoE hardware. Earlier Red Hat Enterprise Linux releases (including RHEL 6, 7, 8, 9.2, 9.6, and 10.0), RHEL 9.6-based and later OpenShift releases, and kernel-rt are not affected because the vulnerable code is not present in the kernel versions they ship.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.