Executive brief
The Linux kernel's NVMe target subsystem incorrectly reports success when memory allocation fails in the RMI (rotational media information) log page handler. This causes the system to tell NVMe hosts that a command succeeded when it actually failed, potentially leading to hosts receiving empty or corrupted data and misinterpreting the device state.
Technical details
The vulnerability is a logic error in nvmet_execute_get_log_page_rmi() where the 'status' variable is initialized to NVME_SC_SUCCESS by a prior nvmet_req_find_ns() call and is not reset when a subsequent kzalloc() fails to allocate memory for the log buffer. The function then jumps to the out label and completes the request, returning success to the host despite the allocation failure. The fix initializes 'status' to NVME_SC_INTERNAL before the allocation attempt, so allocation failures are correctly reported as internal errors. No remote attack vector; this affects the correctness of NVMe target operation on systems with memory pressure.
Affected products
- Linux Linux kernel before fix (5.7.0 or later, when RMI log support was added)
Timeline
- 2026-09-17: disclosed
- 2026-07-29: patched: Upstream fix committed