CVE-2026-80813
Received Received - Intake

NULL Pointer Dereference in Linux Kernel NVMe Target

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() When a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set), nvmet_execute_identify_nslist() is called with match_css set. The command-set filter dereferences req->ns, but this handler never calls nvmet_req_find_ns(), so req->ns is always NULL (nvmet_req_init() resets it to NULL). As soon as an enabled namespace with an NSID greater than the requested value exists, req->ns->csi dereferences a NULL pointer and oopses. Besides the crash, the comparison is logically wrong: to filter the list by command set it must test the command set of the namespace being iterated, not a single fixed value. Use the loop variable ns->csi.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80813
EUVD
EUVD-2026-71248

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference flaw in the Linux kernel's NVMe Target (nvmet) subsystem. It occurs when processing an Identify command with a specific command set number (07h). The function nvmet_execute_identify_nslist() fails to properly initialize the namespace pointer, leading to a crash when accessing namespace attributes.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe Target (nvmet) subsystem and may not have direct network detection commands. Check kernel logs for NULL pointer dereference errors related to nvmet_execute_identify_nslist() after receiving Identify commands with CNS 07h.

Impact Analysis

This vulnerability can cause a system crash (kernel oops) when a host sends a maliciously crafted NVMe Identify command. The crash may lead to denial of service, requiring a system reboot to restore functionality. It does not appear to allow privilege escalation or data theft.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor kernel logs for crashes or errors related to nvmet. Disable NVMe Target (nvmet) if not in use to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80813. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart