{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97409 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97409 is a high-severity vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97409 and fix it if it is affected.\n\nWhat it is: CVE-2026-97409 is a high-severity vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97409 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97409/ (Markdown: https://insights.sbomify.com/CVE-2026-97409/index.md)","id":"CVE-2026-97409","markdown":"https://insights.sbomify.com/CVE-2026-97409/index.md","name":"CVE-2026-97409","record":{"aliases":["AZL-103997","BELL-CVE-2026-97409","DEBIAN-CVE-2026-97409","GHSA-cq4p-q6c3-fqxh","UBUNTU-CVE-2026-97409"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel NVMe driver","requires_auth":"none","summary":"A null pointer dereference in the Linux kernel NVMe FC driver can cause a system crash when an admin request times out before the IO target is initialized.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: Do not cancel requests in io target before it is initialized\n\nA new nvme-fc controller in CONNECTING state sees admin request timeout\nschedules ctrl-\u003eioerr_work to abort inflight requests. This ends up\ncalling __nvme_fc_abort_outstanding_ios() which aborts requests in both\nadmin and io tagsets. In case fc_ctrl-\u003etag_set was not initialized we\nsee the warning below. This is because ctrl.queue_count is initialized\nearly in nvme_fc_alloc_ctrl().\n\nnvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nlpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6).\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nWorkqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x57/0x80\n register_lock_class+0x567/0x580\n __lock_acquire+0x330/0xb90\n lock_acquire.part.0+0xad/0x210\n blk_mq_tagset_busy_iter+0xf9/0xc00\n __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc]\n nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc]\n process_one_work+0x82c/0x1450\n worker_thread+0x5ee/0xfd0\n kthread+0x3a0/0x750\n ret_from_fork+0x439/0x670\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nUpdate the check in __nvme_fc_abort_outstanding_ios() confirm that io\ntagset was created before iterating over busy requests. Also make sure\nto cancel ctrl-\u003eioerr_work before removing io tagset.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"nvme-fc: Do not cancel requests in io target before it is initialized","id":"CVE-2026-97409","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"netconsole: take target_cleanup_list_lock in drop_netconsole_target()","id":"CVE-2026-97410"},"packages":[],"prev":{"headline":"Bluetooth: L2CAP: validate connectionless PSM length","id":"CVE-2026-97408"},"products":["Linux"],"published":"2026-09-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-03","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel NVMe FC driver can cause a system crash when an admin request times out before the IO target is initialized.","url":"https://insights.sbomify.com/CVE-2026-97409/"}