Use of uninitialized resource in Linux kernel - CVE-2026-97409
Published: September 25, 2026
Vulnerability identifier: #VU152057
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-97409
CWE-ID: CWE-908
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disable locking correctness validation.
The vulnerability exists due to use of an uninitialized resource in __nvme_fc_abort_outstanding_ios() when error recovery aborts outstanding requests before the I/O tagset is initialized. A local user can trigger an admin request timeout during controller connection to disable locking correctness validation.
The condition occurs while the NVMe over Fibre Channel controller is in the CONNECTING state.
Affected software
Linux kernel
How to mitigate CVE-2026-97409
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3