A fault in the Linux NVMe‑FC driver causes the kernel to abort I/O requests while the controller’s tag set is still uninitialized. When an NVMe‑FC controller enter a CONNECTING state and an admin request times out, the ioerr_work routine triggers __nvme_fc_abort_outstanding_ios(), which walks both admin and I/O tagsets. If the io‑tag set has not been created yet, this results in a kernel warning and can lead to a kernel panic. The direct consequence is that a local attacker or an application with kernel privileges can force a crash, producing a denial‑of‑service condition for the entire system.

The flaw exists in the Linux kernel NVMe‑FC driver. Any Linux kernel that includes NVMe‑FC support and has not incorporated the fix from the referenced commits is vulnerable. The exact kernel releases affected are not listed in the data; practitioners should check for the presence of the patch or a kernel newer than the commit dates provided.

Because the bug is in kernel space, exploitation requires the attacker to interact with the NVMe‑FC subsystem, for example by initiating connections that trigger the admin timeout path. The vulnerability can be leveraged to crash the kernel, leading to a service outage. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, but the missing initialization check and the potential for a kernel panic suggest a high severity for affected systems. The attack vector is likely local, and the risk is elevated until the patch is applied.