Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() When a… (CVE-2026-80813)

The Linux kernel nvmet subsystem had a vulnerability where the function nvmet_execute_identify_nslist() dereferenced a NULL pointer. When a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set), the function was called with match_css set, but the req->ns pointer was never initialized properly (always NULL). The command-set filter attempted to dereference req->ns->csi, causing a kernel oops if an enabled namespace with an NSID greater than the requested value existed. Additionally, the filtering logic was incorrect, as it tested a fixed value rather than the command set of the iterated namespace. This vulnerability has been resolved by correcting the pointer handling and filtering logic.

The vulnerability leads to a NULL pointer dereference in the Linux kernel nvmet subsystem, causing a kernel crash (oops) when processing certain Identify commands. This results in denial of service due to kernel instability. There is no information about privilege escalation or data corruption. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is applied, avoid sending Identify commands with CNS 07h to vulnerable systems to prevent triggering the NULL pointer dereference. Monitor vendor channels for official fixes.