CVE-2026-80821: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80821 Overview

CVE-2026-80821 is a reference-counting flaw in the Linux kernel's NVMe target (nvmet) PCI Endpoint Function (pci-epf) driver. The function nvmet_pci_epf_create_cq() calls nvmet_cq_create(), which takes a reference on the controller and installs the completion queue. When the subsequent PCI address-space mapping fails or returns a too-small partial mapping, control jumps to the err_internal or err_unmap_queue labels without calling nvmet_cq_put(). A remote PCI host that issues Create IO CQ commands with a failing PRP1/pci_addr leaks a completion queue and a controller reference on every attempt.

Critical Impact
A remote PCI host can trigger controller and completion queue reference leaks in the NVMe target PCI endpoint driver, eventually leading to resource exhaustion and denial of service on the target system.

Affected Products

Linux kernel NVMe target subsystem (drivers/nvme/target/pci-epf.c)
Systems configured as NVMe-over-PCIe endpoints using the nvmet-pci-epf driver
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-09-04 - CVE-2026-80821 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80821

Vulnerability Analysis

The defect lives in the NVMe target PCI Endpoint Function driver, which lets a Linux system present itself as an NVMe controller to a remote PCI host. When the host submits a Create IO Completion Queue admin command, the target invokes nvmet_pci_epf_create_cq(). That function first calls nvmet_cq_create(), which reserves a controller reference and installs the completion queue in the target's queue array.

The function then maps the host's PRP1 address into the endpoint's PCI address space so the target can post completions. If the mapping call fails, or returns a partial mapping smaller than the requested size, the function branches to the err_internal or err_unmap_queue cleanup labels. These paths unwind the mapping state but never call nvmet_cq_put() to release the reference taken by nvmet_cq_create().

The teardown path in nvmet_pci_epf_delete_cq() gates the corresponding put on the NVMET_PCI_EPF_Q_LIVE flag. That flag is set only after the mapping succeeds, so a queue that failed during mapping is never treated as live and never released on shutdown. Each failed Create IO CQ therefore permanently leaks one CQ slot and one controller reference [CWE-401].

Root Cause

The root cause is asymmetric create/put handling across error paths. nvmet_cq_create() unconditionally acquires a reference, but the mapping-failure labels in nvmet_pci_epf_create_cq() were written before that reference existed and were never updated to release it. The compensating put in the delete path is gated on a liveness flag the failed queue never reaches.

Attack Vector

A remote PCI host connected to the NVMe target endpoint can repeatedly issue Create IO CQ admin commands with a PRP1 value that forces the PCI mapping to fail or return a short mapping. Each iteration leaks controller state on the target. Over time, this exhausts queue identifiers and prevents the controller from being torn down, producing a denial-of-service condition against the NVMe target.

Exploitation requires the ability to submit NVMe admin commands to the target, which in the PCI endpoint model means an attacker-controlled or compromised PCI host on the other side of the link. See the upstream commits referenced below for the exact patched code paths: Kernel commit 56a7b6a6880d and Kernel commit f31650243c1a.

Detection Methods for CVE-2026-80821

Indicators of Compromise

Repeated Create IO CQ admin command failures logged by the nvmet-pci-epf driver with mapping or PRP1 errors.
Steady growth in NVMe controller reference counts or queue allocations on the target with no corresponding release events.
Inability to cleanly disable or unbind the NVMe target PCI endpoint function after sustained host activity.

Detection Strategies

Audit kernel logs for nvmet_pci_epf_create_cq error paths returning mapping failures in bursts from a single PCI host.
Track nvmet controller and queue counters over time and alert on monotonic growth that does not correlate with legitimate workload changes.
Compare deployed kernel versions against the fixed stable trees referenced in the upstream commits to identify unpatched hosts.

Monitoring Recommendations

Forward kernel and dmesg output from systems running the NVMe target PCI endpoint role to a centralized log store for anomaly analysis.
Baseline normal Create IO CQ command volume on target systems and alert on sustained deviations, particularly failure spikes.
Monitor memory and slab allocations tied to nvmet structures for slow leaks that indicate abnormal reference retention.

How to Mitigate CVE-2026-80821

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the fix, which drops the CQ reference on the mapping-failure paths in nvmet_pci_epf_create_cq().
Restrict physical and logical access to systems configured as NVMe PCI endpoints so untrusted hosts cannot submit admin commands.
Disable the nvmet-pci-epf driver on systems that do not require NVMe target functionality over PCI endpoint.

Patch Information

The fix adds the missing nvmet_cq_put() call on the err_internal and err_unmap_queue paths, correctly pairing the create and put operations. Patches are available in the upstream stable trees. Refer to Kernel commit 659ae9d02cb5 and Kernel commit b5f97fae2503 for the backported changes.

Workarounds

Unload or blacklist the nvmet-pci-epf module on hosts that do not need to act as NVMe PCI endpoints.
Physically disconnect or administratively isolate any PCI host that is not trusted to issue well-formed NVMe admin commands.
Schedule periodic reboots of NVMe target systems while a patched kernel is being staged to reclaim leaked references.

bash

# Confirm whether the nvmet-pci-epf module is loaded and disable it if unused
lsmod | grep nvmet_pci_epf
sudo modprobe -r nvmet_pci_epf
echo "blacklist nvmet_pci_epf" | sudo tee /etc/modprobe.d/blacklist-nvmet-pci-epf.conf
sudo update-initramfs -u