CVE-2026-23376

Description

A flaw was found in the Linux kernel's nvmet-fcloop component. This vulnerability occurs due to incorrect handling of resource freeing when the remote port state is not online. Specifically, the fcloop_t2h_xmt_ls_rsp routine fails to check the remoteport->port_state before calling a done callback, which can lead to improper resource management. This could potentially result in system instability or resource leaks.

Statement

This flaw affects systems using NVMe over Fibre Channel loopback (fcloop) for testing. The missing port_state check causes incorrect callback handling when the remote port is not online, leading to resource management issues. This is primarily a testing/development driver issue rather than a production deployment concern.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score3.35.5N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowLowN/A
Privileges RequiredLowLowN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneNoneN/A
Integrity ImpactNoneNoneN/A
Availability ImpactLowHighN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Understanding the Weakness (CWE)

CWE-414

Integrity,Availability

Technical Impact: Modify Application Data; DoS: Instability; DoS: Crash, Exit, or Restart

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.