CVE-2026-80813 Overview
CVE-2026-80813 is a NULL pointer dereference vulnerability in the Linux kernel's NVMe target (nvmet) subsystem. The flaw resides in the nvmet_execute_identify_nslist() function, which handles NVMe Identify commands with CNS value 07h (Active Namespace ID List for a specific I/O Command Set). When a host issues this command, the handler dereferences req->ns without first calling nvmet_req_find_ns(), leaving the pointer NULL. Any enabled namespace with an NSID greater than the requested value triggers a kernel oops.
Critical Impact
A remote NVMe-over-Fabrics host can trigger a kernel oops on the target system, resulting in denial of service against the storage target.
Affected Products
- Linux kernel with NVMe target (nvmet) subsystem enabled
- Systems exposing NVMe-over-Fabrics targets to remote initiators
- Distributions shipping affected kernel versions prior to the referenced stable commits
Discovery Timeline
- 2026-09-04 - CVE-2026-80813 published to the National Vulnerability Database
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80813
Vulnerability Analysis
The vulnerability affects the NVMe Target driver path that services Identify commands. The NVMe specification defines CNS 07h as an Identify request returning the Active Namespace ID List filtered by a specific I/O Command Set (CSI). The nvmet_execute_identify_nslist() function accepts a match_css parameter that enables this command-set filtering.
The handler iterates namespaces and, when match_css is set, attempts to compare the command set through req->ns->csi. However, this code path never invokes nvmet_req_find_ns(). Because nvmet_req_init() explicitly resets req->ns to NULL, the pointer remains NULL when the filter runs. The first enabled namespace whose NSID exceeds the requested value triggers a NULL pointer dereference and a kernel oops [CWE-476].
The logic is also semantically incorrect. Filtering the list by command set requires testing the CSI of the namespace being iterated, not a fixed value read through req->ns. The fix replaces the invalid dereference with the loop variable ns->csi, which references the namespace under evaluation.
Root Cause
The root cause is an unchecked pointer dereference combined with a logic error. The handler assumes req->ns is populated for command-set filtering, but the initialization path guarantees it is NULL for this CNS opcode. No defensive check was present, and the intended per-namespace CSI comparison was never implemented correctly.
Attack Vector
An attacker with the ability to send NVMe Identify commands to a target can trigger the crash. In an NVMe-over-Fabrics deployment, this includes any remote host authorized to connect to the target. The attacker sends an Identify command with CNS 07h and any CSI value. If the target has at least one enabled namespace with NSID greater than the requested value, the kernel dereferences NULL and oopses.
The vulnerability manifests in nvmet_execute_identify_nslist(). See the referenced stable kernel commits for the exact patch diff and additional technical context.
Detection Methods for CVE-2026-80813
Indicators of Compromise
- Kernel oops or panic messages referencing nvmet_execute_identify_nslist in the call stack
- dmesg entries showing NULL pointer dereference at the address associated with req->ns->csi access
- Unexpected NVMe-over-Fabrics target service disruptions correlated with inbound Identify traffic
Detection Strategies
- Correlate kernel crash telemetry against installed kernel versions to identify unpatched hosts running the nvmet module
- Monitor NVMe-oF admin queue traffic for Identify commands with CNS 07h originating from unexpected initiators
- Inspect loaded kernel modules across the fleet for nvmet presence on systems that should not expose storage targets
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on BUG: or Oops: entries containing nvmet symbols
- Track NVMe-oF initiator connection sources and flag anomalous or unauthorized hosts
- Baseline expected Identify CNS opcodes issued by legitimate initiators and alert on deviation
How to Mitigate CVE-2026-80813
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected hosts
- Restrict NVMe-over-Fabrics target exposure to trusted initiators only, using host NQN allow-lists
- Audit systems for unnecessary loading of the nvmet module and unload where not required
Patch Information
The fix replaces the NULL req->ns->csi dereference with the iteration variable ns->csi, correcting both the crash and the filtering logic. Patches are available in the mainline and stable kernel trees at Kernel Git Commit 123d664, Kernel Git Commit 2bc1e33, Kernel Git Commit 61dc1a37, and Kernel Git Commit 79aba4c9.
Workarounds
- Unload the nvmet kernel module on systems that do not need to serve NVMe-over-Fabrics targets
- Enforce network segmentation and firewall rules restricting access to NVMe-oF transport ports (TCP, RDMA, or FC)
- Require authenticated initiator connections and remove any wildcard host NQN configurations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.