Use-after-free in Linux kernel - CVE-2026-80787

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nvmet_pci_epf_exec_iod_work() of the nvmet_pci_epf PCI endpoint target when handling I/O commands that do not transfer data from the device to the host. A local user can submit an I/O command that does not require a device-to-host data transfer to cause a denial of service.

The command may complete asynchronously on another CPU, allowing the I/O descriptor to be freed before it is accessed.

Affected software

How to mitigate CVE-2026-80787

External References

• https://git.kernel.org/stable/c/1ed1eeaef55cebf2d74b3ef104c20bdab719b165
• https://git.kernel.org/stable/c/20be486d1c225402b067391e72ff5b0dd8ebff76
• https://git.kernel.org/stable/c/c9e9bb757971485b4e8414b1744507af186d72c9
• https://git.kernel.org/stable/c/cede8d2852570c79b9bbb9527255ae9ed3317b82

Related Security Bulletins

• Use-after-free in Linux kernel nvme target driver