Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone size

CVSS 7.5CVE-2026-89971Kernel, userspace & hypervisorcurated

Impact

nvme_update_ns_info_block() only tests for a negative return from nvme_query_zone_info(), so a positive NVMe status from Identify falls through and the namespace is registered as zoned with a zero zone size. Live limits then drive a shift by ilog2(0) on the I/O submission path. Any device, firmware or NVMe-oF target that fails that one command reaches it, which puts the trigger on the storage side rather than the host side - a misbehaving or hostile NVMe-oF target can push a GPU node into this state. The record describes a crash path only; no privilege gain is claimed.

Who can reach it

A local NVMe device or a remote NVMe-oF target that fails the Identify command during namespace scan or revalidation. No host-side authentication is involved; the host is the victim of what the target answers.

What to do

Pick up the stable kernel with the fix (it skips the zoned limits update and logs the failure) and reboot the node. No fixed version numbers are given in the record, only the three stable commits.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89971 https://git.kernel.org/stable/c/3838e80fcfb32e62baffb63c6dc0a60153665a4d https://git.kernel.org/stable/c/7fad53ae2052a2b4fc7ca567d6555bdb1176ba35

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.