NULL pointer dereference in Linux kernel - CVE-2026-90228
Published: September 18, 2026
Vulnerability identifier: #VU151255
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90228
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in nvmet_execute_identify_ns_zns() when processing a host-supplied Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. A remote attacker can send a crafted Identify command targeting a file-backed namespace to cause a denial of service.
The issue is reachable only when CONFIG_BLK_DEV_ZONED is enabled.
Affected software
Linux kernel
How to mitigate CVE-2026-90228
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f
- https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485
- https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471
- https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00
- https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa
- https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d
- https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d