Double free in Linux kernel - CVE-2026-89974

Vulnerability identifier: #VU150308

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-89974

CWE-ID: CWE-415

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a double free in the nvme-fc controller initialization and cleanup logic when nvme_add_ctrl() fails during controller creation. A remote attacker can trigger the affected error path to compromise confidentiality, integrity, and availability.

The failure is reachable under memory pressure or fault injection.

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
linux (Debian package) - update to 6.12.111-1

• https://git.kernel.org/stable/c/56e6279266f6962bb2d38a54397e3c605165b0c5
• https://git.kernel.org/stable/c/5f89d68c00ccd1b25151da0bf660012380c2bad9
• https://git.kernel.org/stable/c/7df913a7ced5d7349f0b23bdcf25ad54fe83a1c1
• https://git.kernel.org/stable/c/8bd14aa065112b4d523bea690027c7527a6224f6

• Double free in Linux kernel nvme host driver
• Debian update for linux
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more