CVE-2026-80790 (GCVE-0-2026-80790)
Vulnerability from cvelistv5
Published
2026-09-04 15:13
Modified
2026-09-04 15:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-fc: fix invalid free in LS IOD error path
nvmet_fc_alloc_ls_iodlist() advances iod while initializing the LS IOD
array. If an rqstbuf allocation or response buffer DMA mapping fails,
the unwind loop decrements iod past the start of the array. The final
kfree(iod) therefore frees an address before the allocated object.
This can be reproduced with nvme-fcloop and failslab by setting
fail-nth to 6 before creating a target port. KASAN reports:
BUG: KASAN: invalid-free in nvmet_fc_register_targetport
Free of addr ffff88816cf8ff48 by task nvmet_fail_nth/9552
Free the original allocation base stored in tgtport->iod instead. With
this fix applied, the same sysfs write with fail-nth=6 returns -ENOMEM
without any KASAN report.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 Version: c53432030d86429dc9fe5adc3d68cb9d1343b0b2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b189c6e408896ccc23d2e76d7738847cdebf1532",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "449e9c4f8db84ad9d9bb288029b230bcf590faa2",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "1a8f007faefe8c226ec65896589f8d59b0a8d5a5",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "d094582cce9c08516d714e7436a8f3b9211dda90",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "371fb1bf902adaa59be32bd7e904a5317e604fd0",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "8bce9cd08aae4283badf8ddc11fbb6f57b75a81e",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "bb9489f0dce58da730d3479588d6710d7a2c1b45",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "94334ea92f4d7535f66f86e33681efa94827eddc",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
},
{
"lessThan": "ba98d6796d12258e837ece065d2ecb59d76ce4ff",
"status": "affected",
"version": "c53432030d86429dc9fe5adc3d68cb9d1343b0b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: fix invalid free in LS IOD error path\n\nnvmet_fc_alloc_ls_iodlist() advances iod while initializing the LS IOD\narray. If an rqstbuf allocation or response buffer DMA mapping fails,\nthe unwind loop decrements iod past the start of the array. The final\nkfree(iod) therefore frees an address before the allocated object.\n\nThis can be reproduced with nvme-fcloop and failslab by setting\nfail-nth to 6 before creating a target port. KASAN reports:\n\n BUG: KASAN: invalid-free in nvmet_fc_register_targetport\n Free of addr ffff88816cf8ff48 by task nvmet_fail_nth/9552\n\nFree the original allocation base stored in tgtport-\u003eiod instead. With\nthis fix applied, the same sysfs write with fail-nth=6 returns -ENOMEM\nwithout any KASAN report."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:13:02.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b189c6e408896ccc23d2e76d7738847cdebf1532"
},
{
"url": "https://git.kernel.org/stable/c/449e9c4f8db84ad9d9bb288029b230bcf590faa2"
},
{
"url": "https://git.kernel.org/stable/c/1a8f007faefe8c226ec65896589f8d59b0a8d5a5"
},
{
"url": "https://git.kernel.org/stable/c/d094582cce9c08516d714e7436a8f3b9211dda90"
},
{
"url": "https://git.kernel.org/stable/c/371fb1bf902adaa59be32bd7e904a5317e604fd0"
},
{
"url": "https://git.kernel.org/stable/c/8bce9cd08aae4283badf8ddc11fbb6f57b75a81e"
},
{
"url": "https://git.kernel.org/stable/c/bb9489f0dce58da730d3479588d6710d7a2c1b45"
},
{
"url": "https://git.kernel.org/stable/c/94334ea92f4d7535f66f86e33681efa94827eddc"
},
{
"url": "https://git.kernel.org/stable/c/ba98d6796d12258e837ece065d2ecb59d76ce4ff"
}
],
"title": "nvmet-fc: fix invalid free in LS IOD error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80790",
"datePublished": "2026-09-04T15:13:02.193Z",
"dateReserved": "2026-08-26T14:34:25.793Z",
"dateUpdated": "2026-09-04T15:13:02.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…