CVE-2026-89974

A flaw was found in the Linux kernel's nvme-fc component, which handles Non-Volatile Memory Express over Fibre Channel. When a controller is being added and the nvme_add_ctrl() function fails, a specific error handling path does not correctly manage memory. This leads to the same memory region being released twice, a condition known as a double free. This vulnerability can be triggered under memory pressure or through fault injection, resulting in memory corruption and potentially causing the system to crash, leading to a Denial of Service.

A double free in the NVMe/FC host transport can occur when nvme_add_ctrl() fails after the controller was partially initialized. nvmf_create_ctrl() still owns the fabrics options on create_ctrl() failure, but the nvme_fc error path could also free the same options through nvme_fc_ctrl_free(), producing a slab use after free in nvmf_free_options() and a real double free without KASAN. The direct trigger requires the nvme_add_ctrl() failure path, for example allocation failure in dev_set_name() under memory pressure or fault injection, so the base exploitability is local and high complexity. For the CVSS the PR:L is used in the paranoid vector because a local unprivileged user may be able to combine memory pressure with an administrative or automated NVMe FC connect or recovery path, while direct controller creation usually requires higher privileges. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality, integrity, and availability impact due to kernel heap memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.