CVE-2026-90228

Summary

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing.

The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed.

Reject the command with Invalid Field when the namespace is not backed by a block device.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < 1ce8faf90eb0bf5599b90db38500aefea9426485affected
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < b873099944dae5702b4b6db6814d1f1e8d4cfb00affected
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < ff28a93a895912010a7827a0e1445ebe8be53b4daffected
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < cc29f7082b7ab5e0337f27d1fef16359f05fcffaaffected
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < 1fb1236312ee1a600de6b3ca560f0b3fd5a50471affected
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < 0b4cf43f9ca7118590a338de900edbd6047cd89faffected
LinuxLinuxaaf2e048af2704da5869f27b508b288f36d5c7b7 < f594863967d87b7fcbff6e724d51135fd701a13daffected
LinuxLinux5.14affected
LinuxLinux0 < 5.14unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References