A flaw in the Linux kernel nvme-fc driver component creates a risk of system instability or denial of service when an unauthenticated controller is in a connecting state.

This vulnerability resides in the nvme-fc driver, where a race condition occurs during error recovery for controllers in the CONNECTING state. An unauthenticated attacker can trigger the execution of error recovery work before the I/O tagset is properly initialized, leading to memory-related warnings and kernel-level instability.

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation can result in a kernel panic or persistent denial of service, which disrupts critical business operations and infrastructure availability. Given the kernel-level nature of this flaw, it poses a significant risk to the integrity and reliability of systems utilizing NVMe over Fibre Channel connections.

Immediate Action: Update the Linux kernel to version 6.12.111, 6.18.53, or a later stable release where this race condition is resolved.

Proactive Monitoring: Monitor system logs for kernel warnings, trace dumps, or unexpected service resets related to the nvme-fc driver or nvme-reset-wq workqueues.

Compensating Controls: Restrict access to Fibre Channel management interfaces and ensure that NVMe-over-Fabrics traffic is isolated within trusted, secure network segments.

Public Exploit Available: Unknown

The high CVSS score reflects the potential for severe system impact due to the kernel-level nature of this defect. System administrators should prioritize testing and deploying the identified stable kernel patches in their maintenance cycles to prevent potential denial-of-service scenarios.