CVE-2026-80813
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() When a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set), nvmet_execute_identify_nslist() is called with match_css set. The command-set filter dereferences req->ns, but this handler never calls nvmet_req_find_ns(), so req->ns is always NULL (nvmet_req_init() resets it to NULL). As soon as an enabled namespace with an NSID greater than the requested value exists, req->ns->csi dereferences a NULL pointer and oopses. Besides the crash, the comparison is logically wrong: to filter the list by command set it must test the command set of the namespace being iterated, not a single fixed value. Use the loop variable ns->csi.
Affected versions
Linux kernel versions
6.13
and later are affected. Fixed in
6.18.47,
7.1.11,
7.2.1,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-80813?
CVE-2026-80813 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.13 onward and has been patched in 6.18.47, 7.1.11, 7.2.1 and others. CVE-2026-80813 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80813?
Yes. CVE-2026-80813 has been patched. Fixed versions include 6.18.47, 7.1.11, 7.2.1 and others. If you are running Linux kernel 6.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80813 actively exploited?
No. CVE-2026-80813 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.