CVE-2026-80813

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the nvmet execute identify nslist() function. This occurs when a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set) and match css is set. The handler fails to call nvmet req find ns(), leaving the req->ns variable as NULL. Consequently, when an enabled namespace with an NSID greater than the requested value is present, the system attempts to dereference req->ns->csi, leading to a kernel oops. Additionally, the command-set filter logic is incorrect as it references a fixed value instead of the ns->csi loop variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.