HIGH Introduced in 5.14
nvmet IdentifyNs Deref
CVE-2026-90228
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device.
02KernelScan AI Analysis
Risk summary
A remote NVMe-oF host can crash the kernel of a target system by sending a crafted Identify command with ZNS command-set identifier against any file-backed namespace. The crash occurs because the ZNS identify handler dereferences a NULL block-device pointer for file-backed namespaces. Any system running the NVMe-oF target with CONFIG_BLK_DEV_ZONED enabled and at least one file-backed namespace is vulnerable.
Vulnerability analysis
When an NVMe-oF host sends an Identify command using the ZNS command-set identifier against a namespace backed by a file rather than a block device, the ZNS identify handler calls a function that expects a block device pointer. File-backed namespaces have no block device, so the pointer is NULL and the kernel dereferences it, causing an oops or panic. The fix adds a check that rejects the command with an Invalid Field error when the namespace has no block device backing. The vulnerability is reachable by any network-connected NVMe-oF client when the target has CONFIG_BLK_DEV_ZONED enabled and at least one file-backed namespace configured; no special privileges are required on the client side.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.14 | 5.15.221 | 1ce8faf90eb0 |
| 6.1 | 5.14 | 6.1.188 | b873099944da |
| 6.6 | 5.14 | 6.6.157 | ff28a93a8959 |
| 6.12 | 5.14 | 6.12.110 | cc29f7082b7a |
| 6.18 | 5.14 | 6.18.52 | 1fb1236312ee |
| 7.2 | 5.14 | 7.2.6 | 0b4cf43f9ca7 |
| mainline | 5.14 | 7.3-rc1 | f594863967d8 |
| cip/6.12 | 5.14 | 6.12.111-cip32 | cc29f7082b7a |