Look up another CVE · open CVE-2026-89971 in the interactive tracker
CVE-2026-89971
nvme: skip the zoned limits update if the zone info query failed
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/nvme. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89971 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6568-1 · 2026-10-16 · text | 6.12.113-1 | Update the kernel and reboot. DSA-6568-1 shipped the fix on 2026-10-16, in 6.12.113-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
nvme_query_zone_info() returns either a negative errno or a positive NVMe status code, but nvme_update_ns_info_block() only tests for the negative case: ret = nvme_query_zone_info(ns, lbaf, &zi); if (ret < 0) goto out; If the device fails the Identify Namespace (I/O Command Set specific) command, or the Identify Controller command issued by nvme_set_max_append(), the positive status falls through and setup continues with the zero-initialized zone info. nvme_update_zone_info() then marks the queue zoned with chunk_sectors and ns->head->zsze set to zero. blk_validate_zoned_limits() does not check chunk_sectors, so the limits commit succeeds. blk_revalidate_disk_zones() does reject the zero zone size, but by then the limits are live and nothing rolls them back, so I/O keeps being submitted to a zoned queue with a zero zone size and disk_zone_no() shifts by ilog2(0): nvme0n1: Invalid non power of two zone size (0) UBSAN: shift-out-of-bounds in include/linux/blkdev.h:747:16 shift exponent -1 is negative disk_zone_no include/linux/blkdev.h:747 [inline] bio_straddles_zones include/linux/blkdev.h:1058 [inline] blk_zone_wplug_handle_write block/blk-zoned.c:1423 [inline] blk_zone_plug_bio.cold+0x25/0x1c8 block/blk-zoned.c:1605 blk_mq_submit_bio+0x18fb/0x2870 block/blk-mq.c:3196 submit_bh_wbc+0x575/0x740 fs/buffer.c:2824 __block_write_full_folio+0x728/0xdd0 fs/buffer.c:1933 Any device, firmware or NVMe-oF target that fails this one command reaches this. Skip the zoned limits update in that case, and log which of the two things happened: during a revalidation the queue keeps the zone geometry it was last validated with, and on a first scan the namespace is registered without zoned limits, so that it is still available as a handle for admin commands. Neither of the paths in nvme_query_zone_info() that return a positive status logs anything, so the failure would otherwise be silent. zi.zone_size is an exact indicator: every path that returns a positive status returns before it is assigned, and after that the only failure left is -ENODEV, which the caller already handles. Found by FuzzNvme.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/nvme/host/core.c
- What this is
- NVM EXPRESS DRIVERMAINTAINERS section matched on drivers/nvme/host/ · linux-nvme@lists.infradead.org · Supported
- Kernel module
- nvme_core
Check it on the machine
grep -w CONFIG_NVME_CORE /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nvme_corePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidb
- b
- built in on some flavours, a module on others
- Build switch
- CONFIG_NVME_CORE
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.60%, higher than 47.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/nvme
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.9 | 6.12.112 | a75258e651d9 |
| 6.9 | 6.18.52 | 7fad53ae2052 |
| 6.9 | 7.2.5 | bb6dafa79040 |
| 6.9 | 7.3 | 3838e80fcfb3 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-6568-1 | 2026-10-16 | trixie 6.12.113-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The NVMe host core parses Identify responses during namespace scan for PCIe and NVMe-oF (nvme-tcp/rdma/fc). A malicious or compromised NVMe-oF target over routable TCP (typically 4420) can fail the ZNS Identify command and trigger the bug from the network.
- AC:LAttack complexity, low
- A malicious controller only needs to report CSI=ZNS then return a positive NVMe status on Identify CSI-NS or Identify CSI-CTRL; nvme_update_ns_info_block() treats that as success and installs zero zone geometry with no race or victim-specific layout.
- PR:NPrivileges required, none
- The attacker is the connected NVMe-oF peer and needs no host account or capability. NVMe/TCP TLS and DH-HMAC-CHAP are optional and off by default, matching prior NVMe-oF host CNA scoring as PR:N.
- UI:NUser interaction, none
- Namespace scan and AEN Notice Namespace Changed rescans run in nvme_wq once a controller exists, including nvmf-autoconnect. Partition probe and filesystem writeback then submit I/O that hits disk_zone_no with no extra victim action at exploit time.
- S:UScope, unchanged
- The invalid zoned limits and UBSAN shift occur in the host kernel block layer. This is not a VM escape, IOMMU bypass, or other cross-authority boundary.
- C:NConfidentiality impact, none
- The flaw leaves zi zero-initialized and later does sector >> ilog2(0) in disk_zone_no. That is an undefined shift, not an out-of-bounds read, use-after-free, or other kernel memory disclosure primitive.
- I:NIntegrity impact, none
- nvme_update_zone_info() only programs this queue's chunk_sectors and zsze to zero from uncleared zi. There is no out-of-bounds write, use-after-free, or attacker-controlled write/control-flow hijack primitive.
- A:HAvailability impact, high
- FuzzNvme reproduced UBSAN shift-out-of-bounds in disk_zone_no on live I/O after zoned limits committed with zone size 0. CONFIG_UBSAN_TRAP and panic_on_warn panic the host, which kernel CNA guidance scores as high availability.