SB20260905134 - Missing Release of Resource after Effective Lifetime in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80821)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource release in nvmet_pci_epf_create_cq() when processing Create IO completion queue commands with a failing PRP1 or pci_addr mapping. A remote attacker can issue crafted Create IO CQ commands to cause a denial of service.

A too-small partial PCI address-space mapping can also trigger the issue.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/56a7b6a6880dbabe28214ff88df8d229ca3a944a
• https://git.kernel.org/stable/c/659ae9d02cb5d72c76f74fff7441eb8fb64d8f5c
• https://git.kernel.org/stable/c/b5f97fae2503a763fa0f953abf5f121b0fef7d0d
• https://git.kernel.org/stable/c/f31650243c1ab32394077f234685e89ed8dece84