Cloudanix VulnDB

CVE-2026-80813

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's NVMe storage target code can cause the whole system to crash when certain storage commands arrive.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in nvmet_execute_identify_nslist() when handling Identify command with CNS 07h, because req->ns is never initialized and the code dereferences it to access csi.

Why it matters to the business

Kernel crash and denial of service on Linux NVMe target systems exposed to untrusted hosts, potentially disrupting storage services with low but non-zero exploitation probability.

How an attack unfolds

An attacker sends an NVMe Identify command specifying CNS 07h for a command set; the handler iterates namespaces without setting req->ns, triggering NULL dereference on the first enabled namespace with higher NSID.

How to fix it

Apply the upstream kernel patch that initializes req->ns and corrects the command-set filter logic in nvmet_execute_identify_nslist(); rebuild and deploy updated kernel images.

How to confirm the fix worked

Confirm kernel source contains the corrected nvmet_execute_identify_nslist() that uses the loop variable ns->csi; test with Identify CNS 07h commands and verify absence of NULL dereference oops.

Typical attack path

  1. Establish NVMe-oF connection to target
  2. Issue Identify command with CNS 07h and match_css set
  3. Trigger iteration over active namespaces
  4. Dereference uninitialized req->ns causing oops

How to detect it

Search kernel logs and dmesg for oops/panic traces containing nvmet_execute_identify_nslist and references to req->ns or identify namespace list processing.

  • nvmet_execute_identify_nslist
  • NULL pointer dereference in nvmet
  • req->ns->csi

What your security team should do

  • Prioritize patching NVMe target hosts within normal change windows given low EPSS
  • Monitor kernel logs for oops mentioning nvmet_execute_identify_nslist
  • Restrict NVMe-oF exposure to trusted initiators until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() When a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set), nvmet_execute_identify_nslist() is called with match_css set. The command-set filter dereferences req->ns, but this handler never calls nvmet_req_find_ns(), so req->ns is always NULL (nvmet_req_init() resets it to NULL). As soon as an enabled namespace with an NSID greater than the requested value exists, req->ns->csi dereferences a NULL pointer and oopses. Besides the crash, the comparison is logically wrong: to filter the list by command set it must test the command set of the namespace being iterated, not a single fixed value. Use the loop variable ns->csi.

Affected packages

Ecosystem Package Introduced Fixed