CVE-2026-97409

A fault in the Linux kernel NVMe‑FC driver causes the system to attempt to abort I/O requests while the controller’s tag set has not yet been initialized. When a controller enters the CONNECTING state and an administrative request times out, the background work routine triggers a routine that walks both administrative and I/O tagsets. Because the tag set is uninitialized at that point, the routine logs a warning. The kernel warning indicates that an attempt was made to use a resource that was not properly initialized, which could lead to an unstable kernel state. The vulnerability’s severity is reflected in a high CVSS score of 8.8, suggesting that exploitation could impact kernel integrity.

The flaw exists in the Linux kernel NVMe‑FC driver. Any Linux kernel build that includes NVMe‑FC support and has not yet incorporated the patch from the commits referenced in the advisory is potentially vulnerable. The affected kernel releases are not explicitly listed, so administrators should verify whether their kernel version is older than the commit dates provided in the advisory references.

The exploit path requires interaction with the NVMe‑FC subsystem; the description implies an attacker must trigger the administrative timeout path, possibly via local interface access or an application that communicates over Fibre Channel. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the kernel‑level nature and a high CVSS score of 8.8 mean that, once the flaw is triggered, it can lead to kernel instability. The risk remains significant until the patch is applied.