The Linux kernel NVMe Fibre Channel driver had a flaw in the nvme_fc_delete_ctrl() function where the ioerr_work work item was not reliably cancelled before the nvme_fc_ctrl object was freed. Specifically, nvme_fc_delete_association() waits for pending I/O to complete, but an error could cause ioerr_work to be queued after cancel_work_sync() had been called. The fix moves the cancel_work_sync() call to after nvme_fc_delete_association() to ensure ioerr_work is not running when the control object is freed. Without this fix, use-after-free conditions could cause list corruption and kernel crashes, as demonstrated by kernel oops and invalid opcode errors in the provided logs.

Exploitation of this vulnerability can cause kernel memory corruption leading to system crashes (kernel oops), denial of service, and potential loss of data integrity. The vulnerability affects system stability by triggering invalid memory operations in kernel space. There is no indication of privilege escalation or remote code execution in the provided data.

A fix for this vulnerability has been implemented in the Linux kernel by reordering the cancellation of ioerr_work to occur after nvme_fc_delete_association() completes. Users should update their Linux kernel to a version that includes this fix. Since no explicit patch links or fixed versions are provided, check the official Linux kernel advisories or vendor updates for the fixed kernel version. No other mitigations are indicated.