CVE-2026-90412

Low risk· EPSS 9%

Published: 17/09/2026(UTC)Updated: 19/10/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In the Linux kernel, nvmet_execute_get_log_page_rmi() leaves the 'status' variable holding NVME_SC_SUCCESS when kzalloc() for the log buffer fails. The request is then completed with a success status even though no data was transferred. The fix initializes 'status' to NVME_SC_INTERNAL so allocation failures are reported as internal errors.

Risk Assessment

The NVMe host receives a false success confirmation, which can lead to incorrect interpretation of storage state and potential data integrity issues. This affects environments using NVMe over Fabrics with the nvmet target in the kernel.

Recommendation

Update the Linux kernel to a version containing the nvmet fix. If immediate patching is not possible, monitor kernel logs for allocation failures in the nvmet module.

Other vulnerabilities in Linux kernel (nvmet)

CVE-2026-98723Low risk· EPSS 9%
In the Linux kernel's nvmet module, nvmet_ctrl_init_pr() snapshots the controller's hostid before the connect data (including hostid) is copied, so every reservation pc_ref entry stores the nil UUID. As a result, Preempt and Abort operations cannot match the victim's hostid and silently degrade to a plain Preempt, leaving the victim's in-flight I/O running.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS (set by the successful nvmet_req_find_ns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred. Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler, so an allocation failure is reported as an internal error.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS