CVE-2026-80813

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmet_execute_identify_nslist() function by issuing a specific Identify command (CNS 07h). This vulnerability can lead to a kernel crash, resulting in a Denial of Service (DoS) for the affected system.

A NULL pointer dereference in the NVMe target Identify namespace list path occurs because nvmet_execute_identify_nslist can use req ns csi even though this handler does not initialize req ns. A remote NVMe host can trigger this with an Identify command using CNS 07h for Active Namespace ID List for a specific I/O Command Set when an enabled namespace with a larger NSID is present. For the CVSS the PR:N is used because the attacker does not need local privileges on the target, only reachability to the exposed NVMe target endpoint. The issue is network reachable in NVMe over Fabrics deployments, but it is best modeled as AV:A because NVMe targets are usually deployed on isolated storage or data center networks rather than the public Internet. Impact is denial of service via kernel oops or crash. No direct evidence of information disclosure or privilege escalation is supported by the shown code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.