Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF target

Impact

nvmet_execute_identify_nslist() with match_css set dereferences req->ns to filter by command set, but the handler never calls nvmet_req_find_ns(), so req->ns is always NULL. As soon as the target has an enabled namespace with an NSID above the requested value, a single Identify command with CNS 07h oopses the target. The comparison was also logically wrong - it needed the command set of the namespace being iterated, not one fixed value. For an operator this is a remote crash of the NVMe-oF target node from a connected host, taking storage away from every node attached to it; a GPU cluster with jobs mid-checkpoint against that target loses them.

Who can reach it

A connected NVMe-oF host that can submit admin commands to the target - one Identify command with CNS 07h. Requires a completed Fabrics connect, which needs no authentication in the default configuration.

What to do

Take the stable kernel fix on target nodes; it uses the loop variable ns->csi instead of the never-populated req->ns. Kernel change, so each target node reboots onto the patched kernel unless livepatched. There is no runtime toggle for this - a host is free to send CNS 07h - so restricting which initiators can reach the portal is the only interim control.

References

Related entries

• Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mappingCVE-2026-80817 · Linux kernel iommufd (IOAS change_process racing iopt_map_file_pages)Unscored
• Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardownCVE-2026-80818 · Linux kernel iommu/tegra241-cmdqv (NVIDIA Grace SMMUv3 command-queue virtualization)Unscored
• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored
• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: interrupted DAX truncate on O_TRUNC open leaks the invalidate lock, wedging the fileCVE-2026-80855 · Linux kernel FUSE (DAX truncate path in fuse_open)Unscored
• Linux kernel FUSE: setattr writeback failure leaks the invalidate lock on a DAX truncateCVE-2026-80856 · Linux kernel FUSE (DAX truncate path in fuse_do_setattr)Unscored