CVE-2026-90411

nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code only recorded the error and fell through: it left the already-mapped cmd_iu unmapped and still marked the op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call .exit_request() when .init_request() fails, the cmd_iu mapping is leaked for every op whose rsp_iu mapping fails.

Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and returns the error without marking the op idle, so it stays in the FCPOP_STATE_UNINIT state set by the initial memset().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e399441de9115cd472b8ace6c517708273ca7997 to before c0892cfb60a75e2c86ba8e2127b133f6549c12b3Affected e399441de9115cd472b8ace6c517708273ca7997 to before 5e820d04c241c81a47e1940349018690e93d8167Affected e399441de9115cd472b8ace6c517708273ca7997 to before bb0251991420c25e3ceeac40ea09250d79ed7ef0Affected e399441de9115cd472b8ace6c517708273ca7997 to before acc173608ca7abe5dee8983086b44efd8b0dbc84Affected e399441de9115cd472b8ace6c517708273ca7997 to before 18c5781ed8bc2f423c26ec93e47e2057cd76a783Affected e399441de9115cd472b8ace6c517708273ca7997 to before bd764baf82bb46e958a0bd0b481630dd71313055Affected e399441de9115cd472b8ace6c517708273ca7997 to before be5eb47ee3fea338efae1a5b678d6bb5f0fcc931Affected e399441de9115cd472b8ace6c517708273ca7997 to before f49d0c3a8d56a7cda1628ae17341a4a42063563cAffected
LinuxLinux	4.10Affected before 4.10Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e399441de9115cd472b8ace6c517708273ca7997 to before c0892cfb60a75e2c86ba8e2127b133f6549c12b3Affected
e399441de9115cd472b8ace6c517708273ca7997 to before 5e820d04c241c81a47e1940349018690e93d8167Affected
e399441de9115cd472b8ace6c517708273ca7997 to before bb0251991420c25e3ceeac40ea09250d79ed7ef0Affected
e399441de9115cd472b8ace6c517708273ca7997 to before acc173608ca7abe5dee8983086b44efd8b0dbc84Affected
e399441de9115cd472b8ace6c517708273ca7997 to before 18c5781ed8bc2f423c26ec93e47e2057cd76a783Affected
e399441de9115cd472b8ace6c517708273ca7997 to before bd764baf82bb46e958a0bd0b481630dd71313055Affected
e399441de9115cd472b8ace6c517708273ca7997 to before be5eb47ee3fea338efae1a5b678d6bb5f0fcc931Affected
e399441de9115cd472b8ace6c517708273ca7997 to before f49d0c3a8d56a7cda1628ae17341a4a42063563cAffected

LinuxLinux

4.10Affected
before 4.10Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.