{"id":"CVE-2026-23376","title":"nvmet-fcloop: Check remoteport port_state before calling done callback","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fcloop: Check remoteport port_state before calling done callback\n\nIn nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when\nremoteport->port_state…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < f30b95159a53e72529a9ca1667f11cd1970240a7","Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < 31d3817bcd9e192b30abe3cf4b68f69d48864dd2","Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < dd677d0598387ea623820ab2bd0e029c377445a3","Linux 2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e","Linux >= 6.17.3 < 6.18","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:28:56.244322Z"},"published":"2026-03-25","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:33:43.863Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23376","references":[{"url":"https://git.kernel.org/stable/c/f30b95159a53e72529a9ca1667f11cd1970240a7"},{"url":"https://git.kernel.org/stable/c/31d3817bcd9e192b30abe3cf4b68f69d48864dd2"},{"url":"https://git.kernel.org/stable/c/dd677d0598387ea623820ab2bd0e029c377445a3"}],"tags":["cve.org"],"epss":0.00122,"epssPercentile":0.01977,"ingestedAt":"2026-11-05T22:38:32.127Z","slug":"CVE-2026-23376","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fcloop: Check remoteport port_state before calling done callback\n\nIn nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when\nremoteport->port_state is FC_OBJSTATE_ONLINE.  Otherwise, the\nnvme_fc_xmt_ls_rsp's LLDD call to lport->ops->xmt_ls_rsp is expected to\nfail and the nvme-fc transport layer itself will directly call\nnvme_fc_xmt_ls_rsp_free instead of relying on LLDD's done callback to free\nthe lsrsp resources.\n\nUpdate the fcloop_t2h_xmt_ls_rsp routine to check remoteport->port_state.\nIf online, then lsrsp->done callback will free the lsrsp.  Else, return\n-ENODEV to signal the nvme-fc transport to handle freeing lsrsp.\n\n## Affected\n\n- `Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < f30b95159a53e72529a9ca1667f11cd1970240a7`\n- `Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < 31d3817bcd9e192b30abe3cf4b68f69d48864dd2`\n- `Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < dd677d0598387ea623820ab2bd0e029c377445a3`\n- `Linux 2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e`\n- `Linux >= 6.17.3 < 6.18`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}