---
id: CVE-2026-23376
title: 'nvmet-fcloop: Check remoteport port_state before calling done callback'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvmet-fcloop: Check remoteport port_state before calling done callback

  In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when
  remoteport->port_state…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d <
    f30b95159a53e72529a9ca1667f11cd1970240a7
  - >-
    Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d <
    31d3817bcd9e192b30abe3cf4b68f69d48864dd2
  - >-
    Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d <
    dd677d0598387ea623820ab2bd0e029c377445a3
  - Linux 2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e
  - Linux >= 6.17.3 < 6.18
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:28:56.244322Z'
published: '2026-03-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:43.863Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23376'
references:
  - url: 'https://git.kernel.org/stable/c/f30b95159a53e72529a9ca1667f11cd1970240a7'
  - url: 'https://git.kernel.org/stable/c/31d3817bcd9e192b30abe3cf4b68f69d48864dd2'
  - url: 'https://git.kernel.org/stable/c/dd677d0598387ea623820ab2bd0e029c377445a3'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01977
ingestedAt: '2026-11-05T22:38:32.127Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet-fcloop: Check remoteport port_state before calling done callback

In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when
remoteport->port_state is FC_OBJSTATE_ONLINE.  Otherwise, the
nvme_fc_xmt_ls_rsp's LLDD call to lport->ops->xmt_ls_rsp is expected to
fail and the nvme-fc transport layer itself will directly call
nvme_fc_xmt_ls_rsp_free instead of relying on LLDD's done callback to free
the lsrsp resources.

Update the fcloop_t2h_xmt_ls_rsp routine to check remoteport->port_state.
If online, then lsrsp->done callback will free the lsrsp.  Else, return
-ENODEV to signal the nvme-fc transport to handle freeing lsrsp.

## Affected

- `Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < f30b95159a53e72529a9ca1667f11cd1970240a7`
- `Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < 31d3817bcd9e192b30abe3cf4b68f69d48864dd2`
- `Linux >= 10c165af35d225eb033f4edc7fcc699a8d2d533d < dd677d0598387ea623820ab2bd0e029c377445a3`
- `Linux 2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e`
- `Linux >= 6.17.3 < 6.18`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.