CVE-2026-90228 (GCVE-0-2026-90228)
Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-10-19 09:00
VLAI
EPSS
VEX
Title
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
When a host issues an Identify command with CNS 05h (I/O Command Set
specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed
namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on
req->ns->bdev. A file-backed namespace has no block device, so
req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing.
The I/O command set is selected by the host-supplied CSI field and the
command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,
independent of the namespace backing type, so any file-backed namespace
is exposed.
Reject the command with Invalid Field when the namespace is not backed
by a block device.
Severity
7.5 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
aaf2e048af2704da5869f27b508b288f36d5c7b7 , < 1ce8faf90eb0bf5599b90db38500aefea9426485
(git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < b873099944dae5702b4b6db6814d1f1e8d4cfb00 (git) Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < ff28a93a895912010a7827a0e1445ebe8be53b4d (git) Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < cc29f7082b7ab5e0337f27d1fef16359f05fcffa (git) Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < 1fb1236312ee1a600de6b3ca560f0b3fd5a50471 (git) Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < 0b4cf43f9ca7118590a338de900edbd6047cd89f (git) Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < f594863967d87b7fcbff6e724d51135fd701a13d (git) |
guessed | |
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/zns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1ce8faf90eb0bf5599b90db38500aefea9426485",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "b873099944dae5702b4b6db6814d1f1e8d4cfb00",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "ff28a93a895912010a7827a0e1445ebe8be53b4d",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "cc29f7082b7ab5e0337f27d1fef16359f05fcffa",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "1fb1236312ee1a600de6b3ca560f0b3fd5a50471",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "0b4cf43f9ca7118590a338de900edbd6047cd89f",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "f594863967d87b7fcbff6e724d51135fd701a13d",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/zns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()\n\nWhen a host issues an Identify command with CNS 05h (I/O Command Set\nspecific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed\nnamespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on\nreq-\u003ens-\u003ebdev. A file-backed namespace has no block device, so\nreq-\u003ens-\u003ebdev is NULL and bdev_is_zoned() dereferences it, oopsing.\n\nThe I/O command set is selected by the host-supplied CSI field and the\ncommand is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,\nindependent of the namespace backing type, so any file-backed namespace\nis exposed.\n\nReject the command with Invalid Field when the namespace is not backed\nby a block device."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The host-controlled Identify capsule (opcode nvme_admin_identify) carries CNS 05h (NVME_ID_CNS_CS_NS) and CSI 02h (NVME_CSI_ZNS); nvmet-tcp receives that CapsuleCmd in nvmet_tcp_done_recv_pdu() after kernel_accept() and dispatches via nvmet_parse_admin_cmd()/nvmet_execute_identify() into nvmet_execute_identify_ns_zns().\nAC:L - The attacker sets identify.cns and identify.csi on Identify for any enabled file-backed NSID; nvmet_execute_identify() routes CSI=ZNS to nvmet_execute_identify_ns_zns() whenever CONFIG_BLK_DEV_ZONED is built in, then bdev_is_zoned(req-\u003ens-\u003ebdev) hits NULL with no race or layout dependency.\nPR:N - nvmet_check_ctrl_status() after Connect/CC.EN only enforces DH-HMAC-CHAP when a host_key exists; nvmet_check_auth_status() otherwise returns true, nvmet_host_allowed() treats host NQN as an asserted identifier, and allow_any_host subsystems accept any initiator with no Linux credentials.\nUI:N - The remote initiator itself sends Connect, Property Set of CC.EN, then the crafted Identify; no local user must mount a device, open a file, or otherwise interact.\nS:U - The oops occurs in the target kernel\u0027s nvmet-tcp worker while executing nvmet_execute_identify_ns_zns() and stays in that host\u0027s kernel authority; it is not a VM escape or IOMMU/sandbox boundary bypass.\nC:N - bdev_is_zoned() only loads bdev-\u003ebd_queue through the NULL ns-\u003ebdev of a file-backed namespace; nvmet_execute_identify_ns_zns() crashes before nvmet_copy_to_sgl() of the identify buffer, so no kernel data is returned.\nI:N - The fault is a NULL read in bdev_get_queue() via bdev_is_zoned(); no kernel object is overwritten and a pure NULL dereference does not yield a write or control-flow primitive.\nA:H - Calling bdev_is_zoned(req-\u003ens-\u003ebdev) with a NULL file-backed bdev in nvmet_execute_identify_ns_zns() oopses the kernel, crashing the NVMe target."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:00:04.748Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485"
},
{
"url": "https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00"
},
{
"url": "https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d"
},
{
"url": "https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa"
},
{
"url": "https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471"
},
{
"url": "https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f"
},
{
"url": "https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d"
}
],
"title": "nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90228",
"datePublished": "2026-09-17T16:07:36.625Z",
"dateReserved": "2026-09-11T19:38:34.794Z",
"dateUpdated": "2026-10-19T09:00:04.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-90228",
"date": "2026-11-09",
"epss": "0.0068",
"percentile": "0.52664"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/zns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1ce8faf90eb0bf5599b90db38500aefea9426485",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "b873099944dae5702b4b6db6814d1f1e8d4cfb00",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "ff28a93a895912010a7827a0e1445ebe8be53b4d",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "cc29f7082b7ab5e0337f27d1fef16359f05fcffa",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "1fb1236312ee1a600de6b3ca560f0b3fd5a50471",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "0b4cf43f9ca7118590a338de900edbd6047cd89f",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
},
{
"lessThan": "f594863967d87b7fcbff6e724d51135fd701a13d",
"status": "affected",
"version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/zns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()\n\nWhen a host issues an Identify command with CNS 05h (I/O Command Set\nspecific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed\nnamespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on\nreq-\u003ens-\u003ebdev. A file-backed namespace has no block device, so\nreq-\u003ens-\u003ebdev is NULL and bdev_is_zoned() dereferences it, oopsing.\n\nThe I/O command set is selected by the host-supplied CSI field and the\ncommand is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,\nindependent of the namespace backing type, so any file-backed namespace\nis exposed.\n\nReject the command with Invalid Field when the namespace is not backed\nby a block device."
}
],
"id": "CVE-2026-90228",
"lastModified": "2026-10-19T09:19:13.147",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-17T17:17:18.517",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:33:47+00:00",
"cve": "CVE-2026-90228",
"id": "CVE-2026-90228",
"initial_release_date": "2026-09-17T00:00:00+00:00",
"product_status:known_affected": "112",
"product_status:known_not_affected": "91",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90228.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.