Executive brief
The Linux kernel's NVMe driver fails to properly handle errors when querying zone information, allowing the driver to initialize storage zones with a size of zero. This causes a buffer overflow vulnerability when I/O operations attempt to calculate zone boundaries, potentially allowing a denial of service or local privilege escalation on systems using NVMe storage devices with zone functionality.
Technical details
The vulnerability exists in nvme_update_ns_info_block(), which calls nvme_query_zone_info() but only checks for negative errno values, not positive NVMe status codes returned when the command fails. When the Identify Namespace or Identify Controller command fails on a zoned device, the function continues with zero-initialized zone info, resulting in chunk_sectors and zone size (ns->head->zsze) being set to zero. This causes a shift-out-of-bounds in disk_zone_no() when I/O operations call ilog2(0), triggering an undefined behavior sanitizer error. The attack vector is local and requires the system to have an NVMe device configured with zone functionality, though no device interaction is strictly required as the vulnerability can be triggered by any firmware or NVMe-oF target that fails the zone info command. The fix involves skipping the zoned limits update when nvme_query_zone_info() returns a positive status code.
Affected products
- Linux Linux kernel 5.10 and later (versions containing nvme zoned namespace support)
Timeline
- 2026-09-16: disclosed: CVE-2026-89971 published
- 2026-09-16: other: Vulnerability found by FuzzNvme