Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF target

Impact

nvmet_execute_identify_nslist() with match_css set dereferences req->ns to filter by command set, but the handler never calls nvmet_req_find_ns(), so req->ns is always NULL. As soon as the target has an enabled namespace with an NSID above the requested value, a single Identify command with CNS 07h oopses the target. The comparison was also logically wrong - it needed the command set of the namespace being iterated, not one fixed value. For an operator this is a remote crash of the NVMe-oF target node from a connected host, taking storage away from every node attached to it; a GPU cluster with jobs mid-checkpoint against that target loses them.

Who can reach it

A connected NVMe-oF host that can submit admin commands to the target - one Identify command with CNS 07h. Requires a completed Fabrics connect, which needs no authentication in the default configuration.

What to do

Take the stable kernel fix on target nodes; it uses the loop variable ns->csi instead of the never-populated req->ns. Kernel change, so each target node reboots onto the patched kernel unless livepatched. There is no runtime toggle for this - a host is free to send CNS 07h - so restricting which initiators can reach the portal is the only interim control.

References

Related entries

• Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mappingCVE-2026-80817 · Linux kernel iommufd (IOAS change_process racing iopt_map_file_pages)Unscored
• Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardownCVE-2026-80818 · Linux kernel iommu/tegra241-cmdqv (NVIDIA Grace SMMUv3 command-queue virtualization)Unscored
• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored
• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored