CVE-2026-80821
Received Received - Intake

Memory Leak in Linux Kernel NVMe-oF PCIe Endpoint

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on create_cq mapping failure nvmet_pci_epf_create_cq() calls nvmet_cq_create(), which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or returns a too-small partial mapping, the function jumps to err_internal / err_unmap_queue without calling nvmet_cq_put(). The matching put in nvmet_pci_epf_delete_cq() is gated on NVMET_PCI_EPF_Q_LIVE, which is only set after the mapping succeeds, so teardown never releases these references. A remote PCI host that drives Create IO CQ commands with a failing PRP1/pci_addr therefore leaks the CQ and a controller reference on each attempt. Drop the CQ reference on the mapping-failure paths. The err_internal and err_unmap_queue labels are only reachable after nvmet_cq_create() has succeeded, so this pairs the create/put correctly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80821
EUVD
EUVD-2026-71263

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the NVMe over Fabrics (NVMe-oF) target subsystem. When creating a completion queue (CQ) for PCIe endpoint devices, a reference to the controller is taken but not properly released if PCI address-space mapping fails. This leads to a memory/resource leak where the completion queue and controller reference are not freed, causing potential resource exhaustion over time.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe over Fabrics target (nvmet) PCI endpoint function (pci-epf) implementation. Detection requires checking kernel logs for errors related to nvmet_pci_epf_create_cq() or PCI address-space mapping failures. Commands like dmesg | grep nvmet or journalctl -k | grep nvmet may help identify such issues.

Impact Analysis

If you use systems with NVMe over Fabrics (NVMe-oF) over PCIe, an attacker with access to the PCI host could repeatedly trigger this flaw to leak resources. This may cause system instability, crashes, or degraded performance due to resource exhaustion. Systems with high I/O workloads or limited resources are most affected.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, consider disabling the NVMe over Fabrics target (nvmet) PCI endpoint function if it is not required. Monitor kernel logs for related errors as a sign of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart