Executive brief
The Linux kernel's NVMe target (a storage network protocol implementation) can crash when a storage client sends a specially crafted identify command targeting a file-backed namespace with ZNS (Zoned Namespace) support enabled. An attacker with network access to an NVMe target can trigger a kernel crash (denial of service), disrupting storage access for all users on affected systems.
Technical details
This is a NULL pointer dereference vulnerability in the nvmet_execute_identify_ns_zns() function in drivers/nvme/target/zns.c. When CONFIG_BLK_DEV_ZONED is enabled, the kernel routes Identify commands with CSI 02h (ZNS) to this function regardless of the underlying namespace backing type. File-backed namespaces do not have an associated block device (bdev is NULL), but the function calls bdev_is_zoned(req->ns->bdev) without first checking if bdev is NULL, causing a kernel oops. The fix is a simple NULL check: rejecting the command with an "Invalid Field" error when req->ns->bdev is NULL. This requires network reachability to the NVMe target but no authentication; any client can trigger the crash. Patches are available in upstream Linux kernel commits f594863967d87b7fcbff6e724d51135fd701a13d and later.
Affected products
- Linux Linux kernel Affected versions with CONFIG_BLK_DEV_ZONED enabled, fixed by upstream commit f594863967d87b7fcbff6e724d51135fd701a13d
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Upstream Linux kernel fix merged