Cloudanix VulnDB

CVE-2026-80790

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bookkeeping mistake in the Linux kernel's NVMe over Fibre Channel target code can cause the system to free the wrong piece of memory when something goes wrong during setup, which may crash the machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Pointer arithmetic error in nvmet_fc_alloc_ls_iodlist causes kfree to receive an address before the start of the allocated LS IOD array when an rqstbuf or DMA mapping failure occurs during target port registration, resulting in an invalid-free and potential memory corruption.

Why it matters to the business

Linux systems configured as NVMe over Fibre Channel targets may experience kernel instability or crashes during port initialization under memory-pressure or allocation-failure conditions, increasing operational risk for storage fabrics.

How an attack unfolds

An attacker with local access or the ability to induce allocation failures (for example via fault-injection or resource exhaustion) can trigger the error path in nvmet_fc_register_targetport, causing the kernel to free an incorrect address and corrupt memory metadata.

How to fix it

Update the Linux kernel to a version containing the fix that stores and frees the original allocation base from tgtport->iod instead of the advanced pointer. Rebuild and reboot any affected NVMe-FC target systems after applying the patch.

How to confirm the fix worked

Confirm the presence of the corrected nvmet_fc_alloc_ls_iodlist implementation that records the base pointer; re-run the fail-nth reproduction case and verify absence of KASAN invalid-free reports and successful -ENOMEM return.

Typical attack path

  1. Obtain local execution or control over allocation behavior on a Linux NVMe-FC target host
  2. Force nvmet_fc_alloc_ls_iodlist to fail at a specific iteration by exhausting memory or using fault-injection
  3. Trigger the incorrect unwind that decrements the iod pointer below the allocation base
  4. Execute kfree on the invalid address, corrupting the allocator

How to detect it

Examine kernel logs for KASAN invalid-free reports referencing nvmet_fc_register_targetport or nvmet_fc_alloc_ls_iodlist; correlate with target-port creation events and any preceding allocation-failure messages.

What your security team should do

  • Prioritize kernel updates for all systems exposing NVMe-FC target ports
  • Monitor vendor advisories for backported fixes in supported LTS kernels
  • Test storage target initialization under simulated allocation pressure after patching

The record

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmet_fc_alloc_ls_iodlist() advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start of the array. The final kfree(iod) therefore frees an address before the allocated object. This can be reproduced with nvme-fcloop and failslab by setting fail-nth to 6 before creating a target port. KASAN reports: BUG: KASAN: invalid-free in nvmet_fc_register_targetport Free of addr ffff88816cf8ff48 by task nvmet_fail_nth/9552 Free the original allocation base stored in tgtport->iod instead. With this fix applied, the same sysfs write with fail-nth=6 returns -ENOMEM without any KASAN report.

Affected packages

Ecosystem Package Introduced Fixed