CVE-2026-89971: Linux Kernel NVMe Privilege Escalation Flaw

CVE-2026-89971 Overview

CVE-2026-89971 is a Linux kernel vulnerability in the NVMe subsystem. The flaw lives in nvme_update_ns_info_block(), which mishandles the return value of nvme_query_zone_info(). When a device returns a positive NVMe status code instead of a negative errno, the caller treats the failure as success and continues namespace setup with zero-initialized zone information. This produces a zoned block queue with a zero zone size, triggering an undefined shift in disk_zone_no() on subsequent I/O submission. The bug was reported by FuzzNvme.

Critical Impact
A malicious, malfunctioning, or fuzzed NVMe or NVMe-oF target can crash the Linux kernel by returning a positive status to a single Identify command, producing a shift-out-of-bounds condition during zoned I/O.

Affected Products

Linux kernel branches containing the NVMe zoned namespace support in drivers/nvme/host
Systems attaching NVMe or NVMe-oF namespaces where zoned limits are queried at scan or revalidation time
Stable kernel trees prior to commits 3838e80, 7fad53a, and bb6dafa

Discovery Timeline

2026-09-16 - CVE CVE-2026-89971 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89971

Vulnerability Analysis

The defect is a return-value handling error [CWE-253] in the NVMe host driver. nvme_query_zone_info() has two distinct failure modes: negative errno values and positive NVMe status codes returned by the controller. The caller only guards against the negative case with if (ret < 0) goto out;. Positive status codes returned from the Identify Namespace (I/O Command Set specific) command, or from the Identify Controller command issued by nvme_set_max_append(), fall through to nvme_update_zone_info().

With zi.zone_size still zero, the queue is marked zoned and chunk_sectors plus ns->head->zsze are set to zero. blk_validate_zoned_limits() does not check chunk_sectors, so the limits commit succeeds. blk_revalidate_disk_zones() later rejects the zero zone size, but by that point the live queue configuration is already active and nothing rolls it back.

Root Cause

The root cause is asymmetric error handling. The function contract permits both signed errno and positive controller status, yet only one class of failure is checked. The patched code uses zi.zone_size as an exact indicator of whether the query returned before assignment, and skips the zoned limits update when the query failed. On revalidation, the queue retains its previously validated geometry. On first scan, the namespace is registered without zoned limits so it remains usable for admin commands.

Attack Vector

Any attached NVMe device, controller firmware, or NVMe-over-Fabrics target that returns a non-zero status to the Identify Namespace or Identify Controller command reaches the vulnerable path. On subsequent block I/O, disk_zone_no() executes sector >> ilog2(0), producing a shift exponent of -1 and a UBSAN shift-out-of-bounds report. In production builds this results in undefined behavior and a kernel crash, denying service to the host. The condition is reachable over the network when NVMe-oF is in use, which aligns with the network attack vector classification.

No public exploit code is required beyond a target that emits a positive Identify status. Refer to the upstream patches for the exact code change: Kernel Stable Commit 3838e80, Kernel Stable Commit 7fad53a, and Kernel Stable Commit bb6dafa.

Detection Methods for CVE-2026-89971

Indicators of Compromise

Kernel log entries containing Invalid non power of two zone size (0) associated with an nvme namespace.
UBSAN warnings of the form shift-out-of-bounds in include/linux/blkdev.h with shift exponent -1 is negative.
Stack traces referencing disk_zone_no, bio_straddles_zones, blk_zone_wplug_handle_write, or blk_zone_plug_bio following NVMe namespace scan or revalidation.

Detection Strategies

Monitor dmesg and journalctl -k for NVMe zone size errors and UBSAN reports tied to the block layer.
Track NVMe Identify command failures reported by controllers or NVMe-oF targets during namespace scan and rescan events.
Correlate host kernel crashes with recent NVMe-oF connection changes, firmware updates, or newly attached devices.

Monitoring Recommendations

Forward kernel logs to a central SIEM and alert on the specific NVMe and UBSAN signatures listed above.
Baseline healthy nvme id-ns and nvme id-ctrl responses so anomalous positive status codes are flagged.
Watch for host unavailability or storage stack panics on nodes that consume NVMe-oF namespaces from untrusted or shared targets.

How to Mitigate CVE-2026-89971

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 3838e80, 7fad53a, and bb6dafa to the NVMe host driver.
Rebuild or install vendor-provided kernel packages that incorporate these fixes and reboot affected hosts.
Audit NVMe-oF connections and restrict initiators to trusted, validated targets until patches are deployed.

Patch Information

The fix modifies nvme_update_ns_info_block() to skip the zoned limits update when nvme_query_zone_info() returns a positive NVMe status code, using zi.zone_size as an exact indicator of failure. During revalidation the queue keeps its previously validated zone geometry, and on first scan the namespace is registered without zoned limits so it remains reachable for admin commands. Track backports through the stable references: 3838e80, 7fad53a, and bb6dafa.

Workarounds

Avoid attaching NVMe zoned namespaces from controllers or NVMe-oF targets whose firmware behavior is unverified.
Where possible, disable the CONFIG_BLK_DEV_ZONED code path or unload the nvme module on hosts that do not require zoned storage.
Enforce network segmentation and mutual authentication for NVMe-oF fabrics to limit exposure to hostile targets.

bash

# Verify running kernel and confirm the fix is present after patching
uname -r
grep -R "skip the zoned limits update" /usr/src/linux*/drivers/nvme/host/ 2>/dev/null
dmesg | grep -Ei 'nvme|zone size|shift-out-of-bounds'