CVE-2026-90228 (GCVE-0-2026-90228)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < 1ce8faf90eb0bf5599b90db38500aefea9426485 (git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < b873099944dae5702b4b6db6814d1f1e8d4cfb00 (git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < ff28a93a895912010a7827a0e1445ebe8be53b4d (git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < cc29f7082b7ab5e0337f27d1fef16359f05fcffa (git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < 1fb1236312ee1a600de6b3ca560f0b3fd5a50471 (git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < 0b4cf43f9ca7118590a338de900edbd6047cd89f (git)
Affected: aaf2e048af2704da5869f27b508b288f36d5c7b7 , < f594863967d87b7fcbff6e724d51135fd701a13d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/zns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ce8faf90eb0bf5599b90db38500aefea9426485",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            },
            {
              "lessThan": "b873099944dae5702b4b6db6814d1f1e8d4cfb00",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            },
            {
              "lessThan": "ff28a93a895912010a7827a0e1445ebe8be53b4d",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            },
            {
              "lessThan": "cc29f7082b7ab5e0337f27d1fef16359f05fcffa",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            },
            {
              "lessThan": "1fb1236312ee1a600de6b3ca560f0b3fd5a50471",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            },
            {
              "lessThan": "0b4cf43f9ca7118590a338de900edbd6047cd89f",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            },
            {
              "lessThan": "f594863967d87b7fcbff6e724d51135fd701a13d",
              "status": "affected",
              "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/zns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()\n\nWhen a host issues an Identify command with CNS 05h (I/O Command Set\nspecific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed\nnamespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on\nreq-\u003ens-\u003ebdev. A file-backed namespace has no block device, so\nreq-\u003ens-\u003ebdev is NULL and bdev_is_zoned() dereferences it, oopsing.\n\nThe I/O command set is selected by the host-supplied CSI field and the\ncommand is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,\nindependent of the namespace backing type, so any file-backed namespace\nis exposed.\n\nReject the command with Invalid Field when the namespace is not backed\nby a block device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The host-controlled Identify capsule (opcode nvme_admin_identify) carries CNS 05h (NVME_ID_CNS_CS_NS) and CSI 02h (NVME_CSI_ZNS); nvmet-tcp receives that CapsuleCmd in nvmet_tcp_done_recv_pdu() after kernel_accept() and dispatches via nvmet_parse_admin_cmd()/nvmet_execute_identify() into nvmet_execute_identify_ns_zns().\nAC:L - The attacker sets identify.cns and identify.csi on Identify for any enabled file-backed NSID; nvmet_execute_identify() routes CSI=ZNS to nvmet_execute_identify_ns_zns() whenever CONFIG_BLK_DEV_ZONED is built in, then bdev_is_zoned(req-\u003ens-\u003ebdev) hits NULL with no race or layout dependency.\nPR:N - nvmet_check_ctrl_status() after Connect/CC.EN only enforces DH-HMAC-CHAP when a host_key exists; nvmet_check_auth_status() otherwise returns true, nvmet_host_allowed() treats host NQN as an asserted identifier, and allow_any_host subsystems accept any initiator with no Linux credentials.\nUI:N - The remote initiator itself sends Connect, Property Set of CC.EN, then the crafted Identify; no local user must mount a device, open a file, or otherwise interact.\nS:U - The oops occurs in the target kernel\u0027s nvmet-tcp worker while executing nvmet_execute_identify_ns_zns() and stays in that host\u0027s kernel authority; it is not a VM escape or IOMMU/sandbox boundary bypass.\nC:N - bdev_is_zoned() only loads bdev-\u003ebd_queue through the NULL ns-\u003ebdev of a file-backed namespace; nvmet_execute_identify_ns_zns() crashes before nvmet_copy_to_sgl() of the identify buffer, so no kernel data is returned.\nI:N - The fault is a NULL read in bdev_get_queue() via bdev_is_zoned(); no kernel object is overwritten and a pure NULL dereference does not yield a write or control-flow primitive.\nA:H - Calling bdev_is_zoned(req-\u003ens-\u003ebdev) with a NULL file-backed bdev in nvmet_execute_identify_ns_zns() oopses the kernel, crashing the NVMe target."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:55.044Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485"
        },
        {
          "url": "https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d"
        }
      ],
      "title": "nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90228",
    "datePublished": "2026-09-17T16:07:36.625Z",
    "dateReserved": "2026-09-11T19:38:34.794Z",
    "dateUpdated": "2026-09-18T17:53:55.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90228",
      "date": "2026-09-25",
      "epss": "0.007",
      "percentile": "0.51145"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/zns.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1ce8faf90eb0bf5599b90db38500aefea9426485",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b873099944dae5702b4b6db6814d1f1e8d4cfb00",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ff28a93a895912010a7827a0e1445ebe8be53b4d",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc29f7082b7ab5e0337f27d1fef16359f05fcffa",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fb1236312ee1a600de6b3ca560f0b3fd5a50471",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0b4cf43f9ca7118590a338de900edbd6047cd89f",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f594863967d87b7fcbff6e724d51135fd701a13d",
                    "status": "affected",
                    "version": "aaf2e048af2704da5869f27b508b288f36d5c7b7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/zns.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()\n\nWhen a host issues an Identify command with CNS 05h (I/O Command Set\nspecific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed\nnamespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on\nreq-\u003ens-\u003ebdev. A file-backed namespace has no block device, so\nreq-\u003ens-\u003ebdev is NULL and bdev_is_zoned() dereferences it, oopsing.\n\nThe I/O command set is selected by the host-supplied CSI field and the\ncommand is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,\nindependent of the namespace backing type, so any file-backed namespace\nis exposed.\n\nReject the command with Invalid Field when the namespace is not backed\nby a block device."
          }
        ],
        "id": "CVE-2026-90228",
        "lastModified": "2026-09-18T18:17:47.650",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:18.517",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:30:11Z",
      "cve": "CVE-2026-90228",
      "id": "CVE-2026-90228",
      "initial_release_date": "2026-09-21T16:30:11Z",
      "product_status:known_affected": "204",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90228",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90228.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.