SB20260905169 - Use-after-free in Linux kernel nvme target driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-80787)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nvmet_pci_epf_exec_iod_work() of the nvmet_pci_epf PCI endpoint target when handling I/O commands that do not transfer data from the device to the host. A local user can submit an I/O command that does not require a device-to-host data transfer to cause a denial of service.

The command may complete asynchronously on another CPU, allowing the I/O descriptor to be freed before it is accessed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1ed1eeaef55cebf2d74b3ef104c20bdab719b165
• https://git.kernel.org/stable/c/20be486d1c225402b067391e72ff5b0dd8ebff76
• https://git.kernel.org/stable/c/c9e9bb757971485b4e8414b1744507af186d72c9
• https://git.kernel.org/stable/c/cede8d2852570c79b9bbb9527255ae9ed3317b82