Junglewise Threat Intelligence

CVE-2026-90228: Linux kernel NVMe target NULL pointer dereference in ZNS identify

CVE-2026-90228 · Severity: high · CVSS 7.5 · Published 2026-09-17

Executive brief

The Linux kernel's NVMe target (a storage network protocol implementation) can crash when a storage client sends a specially crafted identify command targeting a file-backed namespace with ZNS (Zoned Namespace) support enabled. An attacker with network access to an NVMe target can trigger a kernel crash (denial of service), disrupting storage access for all users on affected systems.

Technical details

This is a NULL pointer dereference vulnerability in the nvmet_execute_identify_ns_zns() function in drivers/nvme/target/zns.c. When CONFIG_BLK_DEV_ZONED is enabled, the kernel routes Identify commands with CSI 02h (ZNS) to this function regardless of the underlying namespace backing type. File-backed namespaces do not have an associated block device (bdev is NULL), but the function calls bdev_is_zoned(req->ns->bdev) without first checking if bdev is NULL, causing a kernel oops. The fix is a simple NULL check: rejecting the command with an "Invalid Field" error when req->ns->bdev is NULL. This requires network reachability to the NVMe target but no authentication; any client can trigger the crash. Patches are available in upstream Linux kernel commits f594863967d87b7fcbff6e724d51135fd701a13d and later.

Affected products

  • Linux Linux kernel Affected versions with CONFIG_BLK_DEV_ZONED enabled, fixed by upstream commit f594863967d87b7fcbff6e724d51135fd701a13d

Timeline

  • 2026-09-17: disclosed
  • 2026-09-14: patched: Upstream Linux kernel fix merged

References

Related threats