Executive brief
A resource leak in the Linux kernel's NVMe PCI endpoint function driver allows a remote PCI host to exhaust system memory by repeatedly sending malformed NVMe I/O completion queue creation commands. Each failed command leaks a completion queue and controller reference, eventually degrading system performance or causing denial of service.
Technical details
The vulnerability is a resource leak in nvmet_pci_epf_create_cq() (drivers/nvme/target/pci-epf.c). The function calls nvmet_cq_create() to allocate and reference a completion queue, then attempts to map it into PCI address space. If the PCI mapping fails or returns an incomplete mapping, the function jumps to error paths (err_internal, err_unmap_queue) without calling nvmet_cq_put() to release the reference. The corresponding cleanup path in nvmet_pci_epf_delete_cq() only releases references if the NVMET_PCI_EPF_Q_LIVE flag is set, which is only set after successful mapping. A remote PCI host can trigger this by sending Create IO CQ commands with invalid or failing PRP1/pci_addr parameters. The fix adds nvmet_cq_put() on the mapping-failure paths to properly pair allocate/release operations.
Affected products
- Linux Linux kernel linux-2.6.11 through linux-7.1 (all versions containing nvmet PCI EPF driver from 0faa0fe6f90e onwards)
Timeline
- 2026-09-04: disclosed: CVE-2026-80821 published on NVD
- 2026-08-04: patched: Patch authored by Yifei Gao
- 2026-08-11: patched: Upstream commit 659ae9d02cb5d72c76f74fff7441eb8fb64d8f5c merged
- 2026-08-27: patched: Stable kernel release via commit 56a7b6a6880dbabe28214ff88df8d229ca3a944a