Strix
64.1K

CVE-2026-90228

HIGHCVSS 7.5/10

Last modified

CVE-2026-90228 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device..

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= aaf2e048af2704da5869f27b508b288f36d5c7b7, < 1ce8faf90eb0bf5599b90db38500aefea9426485; >= aaf2e048af2704da5869f27b508b288f36d5c7b7, < b873099944dae5702b4b6db6814d1f1e8d4cfb00; >= aaf2e048af2704da5869f27b508b288f36d5c7b7, < ff28a93a895912010a7827a0e1445ebe8be53b4d; >= aaf2e048af2704da5869f27b508b288f36d5c7b7, < cc29f7082b7ab5e0337f27d1fef16359f05fcffa; >= aaf2e048af2704da5869f27b508b288f36d5c7b7, < 1fb1236312ee1a600de6b3ca560f0b3fd5a50471; >= aaf2e048af2704da5869f27b508b288f36d5c7b7, < 0b4cf43f9ca7118590a338de900edbd6047cd89f; >= aaf2e048af2704da5869f27b508b288f36d5c7b7, < f594863967d87b7fcbff6e724d51135fd701a13d
LinuxLinux5.14

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-90228?
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device.
How severe is CVE-2026-90228?
CVE-2026-90228 has a CVSS score of 7.5/10 (HIGH severity).
How do I fix CVE-2026-90228?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-90228?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST