CVE-2026-90228 (CVSS 7.5)

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device.

Is your site exposed to CVE-2026-90228?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0067

Probability of exploitation

0.51%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0b4cf43f9ca7118590a338de900edbd6047cd89f https://git.kernel.org/stable/c/1ce8faf90eb0bf5599b90db38500aefea9426485 https://git.kernel.org/stable/c/1fb1236312ee1a600de6b3ca560f0b3fd5a50471 https://git.kernel.org/stable/c/b873099944dae5702b4b6db6814d1f1e8d4cfb00 https://git.kernel.org/stable/c/cc29f7082b7ab5e0337f27d1fef16359f05fcffa https://git.kernel.org/stable/c/f594863967d87b7fcbff6e724d51135fd701a13d https://git.kernel.org/stable/c/ff28a93a895912010a7827a0e1445ebe8be53b4d

Frequently Asked Questions

What is CVE-2026-90228? +

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-90228? +

CVE-2026-90228 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0067, placing it in the 1th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-90228? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-90228