CVE-2026-97409 Linux CVE debrief

Who should care

Defenders managing Linux kernel environments, especially those using nvme-fc, should assess their exposure to this vulnerability. This includes reviewing versions of the Linux kernel in use, understanding the deployment context of nvme-fc, and verifying if patches or updates have been applied to address this issue.

Why it matters

Defenders should care about CVE-2026-97409 as it involves a Linux kernel vulnerability that could potentially lead to warnings or issues in nvme-fc environments. The vulnerability requires verification of exposure, especially in environments using affected Linux kernel versions, and implementation of patches or lockdep annotations to address the issue.

• Verification of Linux kernel versions for potential vulnerability
• Assessment of exposure in environments using nvme-fc
• Implementation of lockdep annotation or proper initialization
• Patching or updating Linux kernel to address the issue

Technical summary

The Linux kernel vulnerability CVE-2026-97409 involves a situation where nvme-fc does not properly handle requests in the io target before it is initialized. This can lead to a warning about trying to register a non-static key. The issue arises in a new nvme-fc controller in the CONNECTING state when an admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This situation can cause a warning because fc_ctrl->tag_set was not initialized. The code requires a lockdep annotation or proper initialization before use.

Defensive priority

Defenders should assess exposure in Linux kernel environments using nvme-fc, focusing on versions where the vulnerability was present, and verify if patching or updates have been applied to address this issue.

Recommended defensive actions

• Assess exposure in Linux kernel environments using nvme-fc
• Verify if patching or updates have been applied to address this issue
• Review Linux kernel versions for potential vulnerability
• Check for lockdep annotation implementation
• Perform asset inventory of systems using affected Linux kernel versions
• Monitor for potential exploitation attempts
• Track and manage exceptions for remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected components. However, specific version details and exploitation information are not provided, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.