CVE-2026-23376: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23376 is a Linux kernel vulnerability in the nvmet-fcloop subsystem where the fcloop_t2h_xmt_ls_rsp routine fails to check the remoteport->port_state before invoking the lsrsp->done callback, potentially leading to improper resource deallocation and denial of service. It was disclosed on March 25, 2026, and affects Linux kernel versions 6.17.3 through 6.18 (before 6.18.17), 6.18.1 through 6.19 (before 6.19.7), and 7.0-rc1 through 7.0-rc7. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), with availability impact classified as High (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-414 (Missing Lock Check) — specifically, the fcloop_t2h_xmt_ls_rsp routine in the nvmet-fcloop kernel module does not verify remoteport->port_state before calling the lsrsp->done callback. In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when remoteport->port_state is FC_OBJSTATE_ONLINE; if the port is offline, the NVMe-FC transport layer is expected to call nvme_fc_xmt_ls_rsp_free directly. Without the state check, the routine may invoke the callback on an offline port, causing double-free or use-after-free conditions in the NVMe-FC storage subsystem. Exploitation requires local access with low privileges and is limited to systems actively using NVMe-FC storage configurations (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation could result in use-after-free conditions, memory corruption, memory leaks, or system crashes affecting the NVMe-FC storage subsystem, leading to a denial of service. The vulnerability has no confidentiality or integrity impact but carries a High availability impact rating. The scope is limited to the local system and does not provide a direct path for lateral movement or data exfiltration (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.18.17, 6.19.7, or 7.0-rc3 or later, which include the corrected fcloop_t2h_xmt_ls_rsp routine. Patches are available via the upstream kernel stable tree. If immediate patching is not feasible, restrict local user access on systems running NVMe-FC configurations and consider disabling the nvmet-fcloop module if it is not actively required. Monitor for unusual NVMe-FC link state transitions as a precautionary measure (Red Hat Bugzilla, Red Hat Advisory).