Executive brief
The Linux kernel's NVMe target subsystem contains a NULL pointer dereference bug in the identify namespace list handler. When a remote host sends a specific Identify command to filter namespaces by command set, the kernel crashes because the code dereferences an uninitialized pointer. An attacker with network access to an NVMe target can trigger this crash, causing a denial of service on the storage device or server hosting NVMe subsystems.
Technical details
The vulnerability is a NULL pointer dereference in the nvmet_execute_identify_nslist() function in drivers/nvme/target/admin-cmd.c. When processing an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set) and the match_css flag is set, the code attempts to dereference req->ns->csi. However, req->ns is never initialized by this handler (it remains NULL after nvmet_req_init()), causing a kernel oops when accessed. Additionally, the logic is incorrect: it should compare the command set of the namespace being iterated (ns->csi) against the requested command set, not a fixed NULL value. The fix is a one-line change: replace req->ns->csi with ns->csi in the comparison. Network-reachable NVMe target endpoints are vulnerable; an attacker with the ability to send NVMe commands can trigger the crash.
Affected products
- Linux Linux kernel
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched