CVE-2026-90228 Linux CVE debrief

Who should care

Linux kernel administrators and developers who manage or use Linux kernel-based systems should be aware of this vulnerability and take necessary actions to mitigate potential impacts. They should verify their configurations, update to patched versions, and monitor for Identify commands with CNS 05h and CSI 02h.

Why it matters

A NULL pointer dereference vulnerability in the Linux kernel's nvmet_execute_identify_ns_zns() function can be triggered when a host issues an Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. This vulnerability has been resolved, and Linux kernel administrators and developers should verify their configurations and update to patched versions.

• Verify Linux kernel configurations for CONFIG_BLK_DEV_ZONED
• Update to patched Linux kernel versions
• Monitor for Identify commands with CNS 05h and CSI 02h
• Assess exposure of file-backed namespaces

Technical summary

The Linux kernel's nvmet_execute_identify_ns_zns() function has a NULL pointer dereference vulnerability when a host issues an Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. The vulnerability is caused by a NULL pointer dereference when a file-backed namespace has no block device. This issue can be resolved by rejecting the command with Invalid Field when the namespace is not backed by a block device. Linux kernel administrators and developers should verify their configurations and update to patched versions.

Defensive priority

Verify Linux kernel configurations and update to patched versions.

Recommended defensive actions

• Verify Linux kernel configurations for CONFIG_BLK_DEV_ZONED
• Update to patched Linux kernel versions
• Monitor for Identify commands with CNS 05h and CSI 02h
• Assess exposure of file-backed namespaces
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by a NULL pointer dereference in nvmet_execute_identify_ns_zns() when a file-backed namespace has no block device. The I/O command set is selected by the host-supplied CSI field, exposing any file-backed namespace when CONFIG_BLK_DEV_ZONED is enabled. The official CVE Program record and NIST NVD detail page provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.