SB20260916133 - Double free in Linux kernel nvme host driver

Description

This security bulletin contains information about 1 vulnerability.

1) Double free (CVE-ID: CVE-2026-89974)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a double free in the nvme-fc controller initialization and cleanup logic when nvme_add_ctrl() fails during controller creation. A remote attacker can trigger the affected error path to compromise confidentiality, integrity, and availability.

The failure is reachable under memory pressure or fault injection.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/56e6279266f6962bb2d38a54397e3c605165b0c5
• https://git.kernel.org/stable/c/5f89d68c00ccd1b25151da0bf660012380c2bad9
• https://git.kernel.org/stable/c/7df913a7ced5d7349f0b23bdcf25ad54fe83a1c1
• https://git.kernel.org/stable/c/8bd14aa065112b4d523bea690027c7527a6224f6