CVE-2026-80813 - Vulnerability Details

- nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

When a host issues an Identify command with CNS 07h (Active Namespace ID
List for a specific I/O Command Set), nvmet_execute_identify_nslist() is
called with match_css set. The command-set filter dereferences req->ns,
but this handler never calls nvmet_req_find_ns(), so req->ns is always
NULL (nvmet_req_init() resets it to NULL). As soon as an enabled
namespace with an NSID greater than the requested value exists,
req->ns->csi dereferences a NULL pointer and oopses.

Besides the crash, the comparison is logically wrong: to filter the list
by command set it must test the command set of the namespace being
iterated, not a single fixed value. Use the loop variable ns->csi.

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel NVMe target driver contains a flaw in the handler for the Identify command with CNS 07h. When this command is received, the code attempts to dereference a namespace pointer that is never set, leading to a NULL pointer dereference and a kernel crash. The crash manifests as an oops, aborting the kernel and causing a denial of service for the host system.

Affected Systems

All Linux systems that run a kernel with the nvmet driver and have not incorporated the commit that fixes the NULL pointer dereference are affected. This includes any default distribution kernel that ships the standard NVMe target module and has not been updated to include the patch.

Risk and Exploitability

An attacker who can reach the NVMe target, such as a remote host using NVMe‑over‑Fabrics, could send the offending Identify command and trigger the crash. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The flaw does not provide an avenue for arbitrary code execution; its impact is limited to a local denial of service via a kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`61c9967cd63448292a64f9ee9aeb6e2053e3a624`	affected	< 61dc1a37e04d4003a19095f54883358330034a39
`61c9967cd63448292a64f9ee9aeb6e2053e3a624`	affected	< 2bc1e33ff6a558c8ceef7c0077f3ef70a15fcba2
`61c9967cd63448292a64f9ee9aeb6e2053e3a624`	affected	< 123d664ac98d6f3464462ad4a530474b91ba9890
`61c9967cd63448292a64f9ee9aeb6e2053e3a624`	affected	< 79aba4c9403419d822972d2851f2a96a2c0531cf

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[61c9967cd63448292a64f9ee9aeb6e2053e3a624,61dc1a37e04d4003a19095f54883358330034a39)`	affected	code_commit	—
`[61c9967cd63448292a64f9ee9aeb6e2053e3a624,2bc1e33ff6a558c8ceef7c0077f3ef70a15fcba2)`	affected	code_commit	—
`[61c9967cd63448292a64f9ee9aeb6e2053e3a624,123d664ac98d6f3464462ad4a530474b91ba9890)`	affected	code_commit	—
`[61c9967cd63448292a64f9ee9aeb6e2053e3a624,79aba4c9403419d822972d2851f2a96a2c0531cf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.13`	affected	semver	—
`[0,6.13)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the nvmet patch that removes the NULL pointer dereference.
If an update is not immediately available, unload or disable the nvmet module to prevent the crash.
Limit NVMe‑over‑Fabrics traffic to trusted hosts or block Identify commands, and monitor kernel logs for oops events.

Generated by OpenCVE AI on September 4, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/123d664ac98d6f3464462ad4a530474b91ba9890
https://git.kernel.org/stable/c/2bc1e33ff6a558c8ceef7c0077f3ef70a15fcba2
https://git.kernel.org/stable/c/61dc1a37e04d4003a19095f54883358330034a39
https://git.kernel.org/stable/c/79aba4c9403419d822972d2851f2a96a2c0531cf

History

Fri, 04 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() When a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set), nvmet_execute_identify_nslist() is called with match_css set. The command-set filter dereferences req->ns, but this handler never calls nvmet_req_find_ns(), so req->ns is always NULL (nvmet_req_init() resets it to NULL). As soon as an enabled namespace with an NSID greater than the requested value exists, req->ns->csi dereferences a NULL pointer and oopses. Besides the crash, the comparison is logically wrong: to filter the list by command set it must test the command set of the namespace being iterated, not a single fixed value. Use the loop variable ns->csi.
Title		nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/123d664ac98d6f3464462ad4a530474b91ba9890 https://git.kernel.org/stable/c/2bc1e33ff6a558c8ceef7c0077f3ef70a15fcba2 https://git.kernel.org/stable/c/61dc1a37e04d4003a19095f54883358330034a39 https://git.kernel.org/stable/c/79aba4c9403419d822972d2851f2a96a2c0531cf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:33.761Z

Updated: 2026-09-04T15:13:33.761Z

Reserved: 2026-08-26T14:34:25.794Z

Link: CVE-2026-80813

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:08.793

Modified: 2026-09-04T16:18:08.793

Link: CVE-2026-80813

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T20:00:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object