CVE-2026-90411

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the

rsp_iu mapping fails, the original code only recorded the error and fell

through: it left the already-mapped cmd_iu unmapped and still marked the

op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call

.exit_request() when .init_request() fails, the cmd_iu mapping is leaked

for every op whose rsp_iu mapping fails.

Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and

returns the error without marking the op idle, so it stays in the

FCPOP_STATE_UNINIT state set by the initial memset().