PT-2026-27741 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-03-27 · CVE-2026-23376

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the nvmet-fcloop component. Specifically, a missing check for the remoteport port state before invoking the done callback in nvme fc handle ls rqst work can lead to issues. The lsrsp->done callback is only set when remoteport->port state is FC OBJSTATE ONLINE. If not online, the nvme fc xmt ls rsp function is expected to fail, and the transport layer should directly free resources. The update to fcloop t2h xmt ls rsp addresses this by checking remoteport->port state before calling the callback.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23376

Affected Products

Linux Kernel

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23376.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-23376 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23376 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23376 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23376 · Security Note
• https://git.kernel.org/stable/c/f30b95159a53e72529a9ca1667f11cd1970240a7 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23376 · Vendor Advisory
• https://git.kernel.org/stable/c/dd677d0598387ea623820ab2bd0e029c377445a3 · Patch
• https://git.kernel.org/stable/c/31d3817bcd9e192b30abe3cf4b68f69d48864dd2 · Patch
• https://osv.dev/vulnerability/CVE-2026-23376 · Vendor Advisory
• https://twitter.com/CVEarity/status/2037565402067480978 · Twitter Post
• https://git.kernel.org/linus/dd677d0598387ea623820ab2bd0e029c377445a3 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/2036763466992693572 · Twitter Post