DEBIAN-CVE-2026-89971

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...

AZL-101552 CVE-2026-89972 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with listdelrcu&ns-siblings but does not wait for SRCU readers before freeing the namespace...

DEBIAN-CVE-2026-89972

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with listdelrcu&ns-siblings but does not wait for SRCU readers before freeing the namespace...

CVE-2026-89972

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvmeallocns error path at outunlinkns removes ns from the namespace head siblings list with listdelrcu&ns-siblings but does not wait for SRCU readers before freeing the namespace...

CVE-2026-89971

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...

DEBIAN-CVE-2026-89857

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

AZL-101367 CVE-2026-89857 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89975 nvme-fabrics: fix DHCHAP secret leak on parse failure

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmfparseoptions duplicates dhchapsecret and dhchapctrlsecret with matchstrdup before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL...

CVE-2026-89974 nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error, so a transport must not free them on its own error paths. nvme-fc...

CVE-2026-89974 nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error, so a transport must not free them on its own error paths. nvme-fc...

EUVD-2026-80574

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error, so a transport must not free them on its own error paths. nvme-fc...

CVE-2026-89974

CVE-2026-89974 is a double free vulnerability in the Linux kernel's nvme-fc (NVMe over Fibre Channel) transport . The fabrics options pointer (ctrl->ctrl.opts) is freed by both nvme_fc_ctrl_free() and nvmf_create_ctrl() when nvme_add_ctrl() fails, after commit 1a9e218195a5 introduced a second ...

EUVD-2026-80575

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmfparseoptions duplicates dhchapsecret and dhchapctrlsecret with matchstrdup before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL...

CVE-2026-89975

Linux kernel nvme-fabrics contains a memory leak in the DHCHAP secret parsing path. When nvmf_parse_options() validates a dhchap_secret or dhchap_ctrl_secret value and the DHHC-1: representation check fails, the temporary string duplicated by match_strdup() is never assigned to the options struct...

CVE-2026-89975 nvme-fabrics: fix DHCHAP secret leak on parse failure

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmfparseoptions duplicates dhchapsecret and dhchapctrlsecret with matchstrdup before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL...

CVE-2026-89973 nvme-tcp: check the data direction of a C2HData PDU

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

CVE-2026-89973

CVE-2026-89973 affects the nvme-tcp driver in the Linux kernel. The function nvme_tcp_handle_c2h_data() validates a C2HData PDU's command ID and payload presence but does not check the data direction . A malicious or buggy NVMe controller can trigger a kernel warning (WARN_ON_ONCE in _copy_to_ite...

EUVD-2026-80573

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

CVE-2026-89973 nvme-tcp: check the data direction of a C2HData PDU

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: check the data direction of a C2HData PDU nvmetcphandlec2hdata finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answer...

CVE-2026-89972

CVE-2026-89972 is a use-after-free vulnerability in the Linux kernel NVMe subsystem . The error path in nvme_alloc_ns() removes a namespace from the siblings list via list_del_rcu() but fails to call synchronize_srcu() before freeing the namespace struct. Concurrent readers in nvme_find_path() an...