CVE-2026-90228nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from aaf2e048af2704da5869f27b508b288f36d5c7b7 before 1ce8faf90eb0bf5599b90db38500aefea9426485; from aaf2e048af2704da5869f27b508b288f36d5c7b7 before b873099944dae5702b4b6db6814d1f1e8d4cfb00; from aaf2e048af2704da5869f27b508b288f36d5c7b7 before ff28a93a895912010a7827a0e1445ebe8be53b4d; from aaf2e048af2704da5869f27b508b288f36d5c7b7 before cc29f7082b7ab5e0337f27d1fef16359f05fcffa; from aaf2e048af2704da5869f27b508b288f36d5c7b7 before 1fb1236312ee1a600de6b3ca560f0b3fd5a50471; from aaf2e048af2704da5869f27b508b288f36d5c7b7 before 0b4cf43f9ca7118590a338de900edbd6047cd89f; from aaf2e048af2704da5869f27b508b288f36d5c7b7 before f594863967d87b7fcbff6e724d51135fd701a13d | CNA record |
References
- https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485
- https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00
- https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d
- https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa
- https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471
- https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f
- https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.