CVE-2026-80790: Linux Kernel nvmet-fc Use-After-Free Vulnerability

CVE-2026-80790 Overview

CVE-2026-80790 is a memory management flaw in the Linux kernel's nvmet-fc module, which implements the NVMe over Fibre Channel target driver. The function nvmet_fc_alloc_ls_iodlist() advances the iod pointer while initializing the Link Service (LS) IOD array. When an rqstbuf allocation or response buffer DMA mapping fails, the error-unwind loop decrements iod past the start of the array. The final kfree(iod) then frees an address before the originally allocated object, producing an invalid free detected by KASAN.

Critical Impact
An invalid free during NVMe-FC target port initialization can corrupt kernel heap metadata, potentially leading to kernel memory corruption or denial of service on systems using NVMe over Fibre Channel targets.

Affected Products

Linux kernel versions containing the nvmet-fc LS IOD allocation code prior to the fix commits
Systems configured with NVMe over Fibre Channel target functionality (CONFIG_NVME_TARGET_FC)
Environments using nvme-fcloop for testing or production NVMe-FC target ports

Discovery Timeline

2026-09-04 - CVE-2026-80790 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80790

Vulnerability Analysis

The defect resides in nvmet_fc_alloc_ls_iodlist(), part of the Linux kernel's NVMe-FC target subsystem. During initialization, the function iterates through the LS IOD array using a moving iod pointer to configure each element. Each iteration allocates an rqstbuf and performs a DMA mapping for the response buffer.

If any of these per-element operations fail partway through the loop, the function enters an error path that unwinds previously initialized entries. The unwind loop decrements the same iod pointer to walk backwards. Because the pointer was advanced during forward iteration, the final kfree(iod) call passes an address that sits before the base of the originally allocated block.

Reproducing the issue requires nvme-fcloop combined with failslab fault injection. Setting fail-nth to 6 prior to creating a target port triggers the invalid free, and KASAN reports: BUG: KASAN: invalid-free in nvmet_fc_register_targetport.

Root Cause

The root cause is a pointer arithmetic error in error-path cleanup logic. The allocation base pointer was not preserved separately from the iteration cursor. When cleanup ran, kfree() received an offset pointer rather than the original allocation address returned by kmalloc(). This violates the kernel slab allocator contract that requires kfree() receive the exact pointer produced by the corresponding allocation call.

Attack Vector

Exploitation requires local privileges sufficient to configure NVMe-FC target ports through sysfs, and typically a mechanism to induce allocation failures such as failslab. In production environments without fault injection enabled, the invalid free is reachable only under genuine memory pressure that causes rqstbuf allocation or DMA mapping to fail during target port creation.

The fix, distributed across kernel commits including 1a8f007f, 371fb1bf, 449e9c4f, 8bce9cd0, 94334ea9, b189c6e4, ba98d679, bb9489f0, and d094582c, stores the original allocation base in tgtport->iod and passes that pointer to kfree() during cleanup. After the patch, the same fault-injection scenario returns -ENOMEM cleanly without KASAN violations.

Detection Methods for CVE-2026-80790

Indicators of Compromise

KASAN reports referencing invalid-free in nvmet_fc_register_targetport in kernel logs
Kernel panics or slab corruption traces originating from nvmet_fc_alloc_ls_iodlist()
dmesg entries showing -ENOMEM returns from NVMe-FC target port creation coinciding with slab allocator warnings

Detection Strategies

Enable KASAN in test and staging kernels to surface invalid free events during NVMe-FC target initialization
Audit installed kernel versions against the fix commits listed in the kernel.org stable references
Monitor dmesg and journalctl -k for nvmet_fc warnings, slab corruption reports, or allocator sanity check failures

Monitoring Recommendations

Forward kernel logs from Fibre Channel target hosts to a centralized logging pipeline for pattern matching on nvmet_fc and KASAN strings
Track sysfs write activity to NVMe-FC configuration paths and correlate with subsequent kernel warnings
Alert on unexpected reboots or kernel oops events on systems providing NVMe-FC target services

How to Mitigate CVE-2026-80790

Immediate Actions Required

Identify all hosts running NVMe-FC target functionality by checking for the nvmet_fc module and /sys/kernel/config/nvmet/ports/*/addr_trtype entries containing fc
Apply the stable kernel updates corresponding to your distribution that include the referenced fix commits
Restrict local administrative access to sysfs configuration paths used to create NVMe-FC target ports

Patch Information

The fix is available in the Linux stable trees through commits 1a8f007f, 371fb1bf, 449e9c4f, 8bce9cd0, 94334ea9, b189c6e4, ba98d679, bb9489f0, and d094582c. The patch stores the original allocation base in tgtport->iod and frees that pointer instead of the decremented iterator.

Workarounds

Unload the nvmet_fc module on systems that do not require NVMe over Fibre Channel target functionality using modprobe -r nvmet_fc
Blacklist nvmet_fc and nvme_fcloop where these features are not needed to prevent inadvertent loading
Avoid enabling failslab fault injection on production hosts to eliminate the deterministic reproducer path

bash

# Verify nvmet_fc module status and blacklist if unused
lsmod | grep nvmet_fc
echo "blacklist nvmet_fc" | sudo tee /etc/modprobe.d/nvmet-fc-blacklist.conf
echo "blacklist nvme_fcloop" | sudo tee -a /etc/modprobe.d/nvmet-fc-blacklist.conf
sudo modprobe -r nvmet_fc nvme_fcloop 2>/dev/null