CVE-2026-90228

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

State: Published
Severity: 7.5 High
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing.

The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed.

Reject the command with Invalid Field when the namespace is not backed by a block device.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	aaf2e048af2704da5869f27b508b288f36d5c7b7 to before 1ce8faf90eb0bf5599b90db38500aefea9426485Affected aaf2e048af2704da5869f27b508b288f36d5c7b7 to before b873099944dae5702b4b6db6814d1f1e8d4cfb00Affected aaf2e048af2704da5869f27b508b288f36d5c7b7 to before ff28a93a895912010a7827a0e1445ebe8be53b4dAffected aaf2e048af2704da5869f27b508b288f36d5c7b7 to before cc29f7082b7ab5e0337f27d1fef16359f05fcffaAffected aaf2e048af2704da5869f27b508b288f36d5c7b7 to before 1fb1236312ee1a600de6b3ca560f0b3fd5a50471Affected aaf2e048af2704da5869f27b508b288f36d5c7b7 to before 0b4cf43f9ca7118590a338de900edbd6047cd89fAffected aaf2e048af2704da5869f27b508b288f36d5c7b7 to before f594863967d87b7fcbff6e724d51135fd701a13dAffected
LinuxLinux	5.14Affected before 5.14Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

aaf2e048af2704da5869f27b508b288f36d5c7b7 to before 1ce8faf90eb0bf5599b90db38500aefea9426485Affected
aaf2e048af2704da5869f27b508b288f36d5c7b7 to before b873099944dae5702b4b6db6814d1f1e8d4cfb00Affected
aaf2e048af2704da5869f27b508b288f36d5c7b7 to before ff28a93a895912010a7827a0e1445ebe8be53b4dAffected
aaf2e048af2704da5869f27b508b288f36d5c7b7 to before cc29f7082b7ab5e0337f27d1fef16359f05fcffaAffected
aaf2e048af2704da5869f27b508b288f36d5c7b7 to before 1fb1236312ee1a600de6b3ca560f0b3fd5a50471Affected
aaf2e048af2704da5869f27b508b288f36d5c7b7 to before 0b4cf43f9ca7118590a338de900edbd6047cd89fAffected
aaf2e048af2704da5869f27b508b288f36d5c7b7 to before f594863967d87b7fcbff6e724d51135fd701a13dAffected

LinuxLinux

5.14Affected
before 5.14Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.