{"id":"CVE-2026-90228","summary":"nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()\n\nWhen a host issues an Identify command with CNS 05h (I/O Command Set\nspecific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed\nnamespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on\nreq-\u003ens-\u003ebdev. A file-backed namespace has no block device, so\nreq-\u003ens-\u003ebdev is NULL and bdev_is_zoned() dereferences it, oopsing.\n\nThe I/O command set is selected by the host-supplied CSI field and the\ncommand is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,\nindependent of the namespace backing type, so any file-backed namespace\nis exposed.\n\nReject the command with Invalid Field when the namespace is not backed\nby a block device.","modified":"2026-09-19T03:47:25.439487699Z","published":"2026-09-17T16:07:36.625Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90228.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90228.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90228"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"aaf2e048af2704da5869f27b508b288f36d5c7b7"},{"fixed":"1ce8faf90eb0bf5599b90db38500aefea9426485"},{"fixed":"b873099944dae5702b4b6db6814d1f1e8d4cfb00"},{"fixed":"ff28a93a895912010a7827a0e1445ebe8be53b4d"},{"fixed":"cc29f7082b7ab5e0337f27d1fef16359f05fcffa"},{"fixed":"1fb1236312ee1a600de6b3ca560f0b3fd5a50471"},{"fixed":"0b4cf43f9ca7118590a338de900edbd6047cd89f"},{"fixed":"f594863967d87b7fcbff6e724d51135fd701a13d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90228.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.14.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90228.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}