{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23376", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.003Z", "datePublished": "2026-03-25T10:27:56.458Z", "dateUpdated": "2026-05-11T22:05:40.786Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:40.786Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fcloop: Check remoteport port_state before calling done callback\n\nIn nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when\nremoteport->port_state is FC_OBJSTATE_ONLINE. Otherwise, the\nnvme_fc_xmt_ls_rsp's LLDD call to lport->ops->xmt_ls_rsp is expected to\nfail and the nvme-fc transport layer itself will directly call\nnvme_fc_xmt_ls_rsp_free instead of relying on LLDD's done callback to free\nthe lsrsp resources.\n\nUpdate the fcloop_t2h_xmt_ls_rsp routine to check remoteport->port_state.\nIf online, then lsrsp->done callback will free the lsrsp. Else, return\n-ENODEV to signal the nvme-fc transport to handle freeing lsrsp."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/target/fcloop.c"], "versions": [{"version": "10c165af35d225eb033f4edc7fcc699a8d2d533d", "lessThan": "f30b95159a53e72529a9ca1667f11cd1970240a7", "status": "affected", "versionType": "git"}, {"version": "10c165af35d225eb033f4edc7fcc699a8d2d533d", "lessThan": "31d3817bcd9e192b30abe3cf4b68f69d48864dd2", "status": "affected", "versionType": "git"}, {"version": "10c165af35d225eb033f4edc7fcc699a8d2d533d", "lessThan": "dd677d0598387ea623820ab2bd0e029c377445a3", "status": "affected", "versionType": "git"}, {"version": "2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/target/fcloop.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f30b95159a53e72529a9ca1667f11cd1970240a7"}, {"url": "https://git.kernel.org/stable/c/31d3817bcd9e192b30abe3cf4b68f69d48864dd2"}, {"url": "https://git.kernel.org/stable/c/dd677d0598387ea623820ab2bd0e029c377445a3"}], "title": "nvmet-fcloop: Check remoteport port_state before calling done callback", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "01823571-21C8-47A7-A81B-D79D8F3C5262", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "07E9D8CD-82F0-4CC6-8038-BF71758D583C", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*", "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fcloop: Check remoteport port_state before calling done callback\n\nIn nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when\nremoteport->port_state is FC_OBJSTATE_ONLINE. Otherwise, the\nnvme_fc_xmt_ls_rsp's LLDD call to lport->ops->xmt_ls_rsp is expected to\nfail and the nvme-fc transport layer itself will directly call\nnvme_fc_xmt_ls_rsp_free instead of relying on LLDD's done callback to free\nthe lsrsp resources.\n\nUpdate the fcloop_t2h_xmt_ls_rsp routine to check remoteport->port_state.\nIf online, then lsrsp->done callback will free the lsrsp. Else, return\n-ENODEV to signal the nvme-fc transport to handle freeing lsrsp."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvmet-fcloop: Verificar el estado del puerto de remoteport antes de llamar a la funci\u00f3n de devoluci\u00f3n de llamada 'done'\n\nEn nvme_fc_handle_ls_rqst_work, la funci\u00f3n de devoluci\u00f3n de llamada lsrsp->done solo se establece cuando el estado del puerto de remoteport es FC_OBJSTATE_ONLINE. De lo contrario, se espera que la llamada LLDD de nvme_fc_xmt_ls_rsp a lport->ops->xmt_ls_rsp falle y la propia capa de transporte nvme-fc llamar\u00e1 directamente a nvme_fc_xmt_ls_rsp_free en lugar de depender de la funci\u00f3n de devoluci\u00f3n de llamada 'done' de LLDD para liberar los recursos de lsrsp.\n\nActualizar la rutina fcloop_t2h_xmt_ls_rsp para verificar el estado del puerto de remoteport. Si est\u00e1 en l\u00ednea, entonces la funci\u00f3n de devoluci\u00f3n de llamada lsrsp->done liberar\u00e1 el lsrsp. De lo contrario, devolver -ENODEV para indicar al transporte nvme-fc que se encargue de liberar lsrsp."}], "id": "CVE-2026-23376", "lastModified": "2026-04-24T16:21:52.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-25T11:16:37.383", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31d3817bcd9e192b30abe3cf4b68f69d48864dd2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd677d0598387ea623820ab2bd0e029c377445a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f30b95159a53e72529a9ca1667f11cd1970240a7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvmet-fcloop: Check remoteport port_state before calling done callback", "id": "2451267", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451267"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-414", "details": ["A flaw was found in the Linux kernel's nvmet-fcloop component. This vulnerability occurs due to incorrect handling of resource freeing when the remote port state is not online. Specifically, the `fcloop_t2h_xmt_ls_rsp` routine fails to check the `remoteport->port_state` before calling a done callback, which can lead to improper resource management. This could potentially result in system instability or resource leaks."], "name": "CVE-2026-23376", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23376\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23376\nhttps://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23376-114a@gregkh/T"], "statement": "This flaw affects systems using NVMe over Fibre Channel loopback (fcloop) for testing. The missing port_state check causes incorrect callback handling when the remote port is not online, leading to resource management issues. This is primarily a testing/development driver issue rather than a production deployment concern.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10c165af35d225eb033f4edc7fcc699a8d2d533d,f30b95159a53e72529a9ca1667f11cd1970240a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10c165af35d225eb033f4edc7fcc699a8d2d533d,31d3817bcd9e192b30abe3cf4b68f69d48864dd2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10c165af35d225eb033f4edc7fcc699a8d2d533d,dd677d0598387ea623820ab2bd0e029c377445a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:00:05.726453+00:00", "value": {"mitigation_remediation": ["Check your distribution\u2019s repository or vendor site for the latest kernel that includes the nvmet\u2011fcloop fix", "Apply the update and reboot into the new kernel", "If an updated kernel is not yet available, consider disabling NVMe\u2011FC loopback functionality until the patch is released", "Monitor vendor advisories for future updates"], "summary": {"action": "Patch Update", "impact": "Denial of Service via improper resource handling"}, "threat_synthesis": {"affected_systems": "The flaw is confined to the Linux kernel\u2019s NVMe\u2011FC subsystem, specifically the nvmet\u2011fcloop component. All installations running a kernel version prior to the mitigate commit are vulnerable. The fixed code resides in the NVMe\u2011FC loopback handling routine and is incorporated into the latest stable kernel releases.", "description_and_impact": "In the Linux kernel\u2019s NVMe\u2011FC loopback implementation, a callback intended to free a response structure is only set when the remote port is online. When the remote port is offline, the structure is freed by an alternate path, which can lead to improper resource cleanup. This improper resource management may cause memory leaks or kernel crashes, threatening system availability. Based on the description, it is inferred that an attacker could trigger this flaw by sending crafted NVMe\u2011FC loopback requests that cause remote port state changes, resulting in delayed or duplicated cleanup operations.", "risk_and_exploitability": "The CVSS score of 5.5 classifies the issue as moderate severity, while an EPSS score below 1% and absence from CISA\u2019s KEV catalog indicate a low exploitation likelihood. Based on the description, it is inferred that the attack vector most likely requires local privilege or the ability to send crafted NVMe\u2011FC loopback requests. This suggests remote exploitation is unlikely, but the potential denial\u2011of\u2011service impact warrants timely patching."}}}}, "created": "2026-03-25T21:31:39.823173+00:00", "updated": "2026-04-28T17:00:13.474328+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}