Cloudanix VulnDB

CVE-2026-90412

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel storage bug can make certain commands look like they worked when they actually failed because of memory problems, potentially confusing connected storage systems.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A memory allocation failure in nvmet_execute_get_log_page_rmi() leaves the status variable holding a prior success code, causing the NVMe command to complete successfully with no data transferred instead of reporting an internal error.

Why it matters to the business

NVMe over Fabrics targets may silently return incomplete log data to hosts, leading to misbehaving storage initiators, failed diagnostics, or operational disruptions in enterprise storage fabrics.

How an attack unfolds

An attacker able to issue RMI get log page commands against an nvmet target induces memory pressure to trigger kzalloc failure; the target then reports success without data, allowing the host to proceed under false assumptions about command outcome.

How to fix it

Upgrade the Linux kernel to a version containing the fix that initializes status to NVME_SC_INTERNAL before the kzalloc call in nvmet_execute_get_log_page_rmi().

How to confirm the fix worked

Inspect the nvmet source for nvmet_execute_get_log_page_rmi() and confirm status is preset to NVME_SC_INTERNAL prior to allocation, then test allocation-failure paths return error status.

Typical attack path

  1. Issue nvmet RMI get log page commands to the target
  2. Induce memory exhaustion on the target system
  3. Observe the command completing with success status and zero data transferred

How to detect it

Search kernel logs and nvmet traces for get log page operations completing with success status immediately after reported allocation failures.

What your security team should do

  • Apply the kernel patch resolving the nvmet status initialization bug
  • Monitor kernel logs for nvmet allocation failures during log page handling
  • Validate nvmet configurations in test environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS (set by the successful nvmet_req_find_ns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred. Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler, so an allocation failure is reported as an internal error.

Affected packages

Ecosystem Package Introduced Fixed