Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80790— nvmet-fc: fix invalid free in LS IOD error path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于drivers/nvme/target/fc.c文件中nvmet_fc_alloc_ls_iodlist()函数在rqstbuf分配或响应缓冲区DMA映射失败时的错误路径处理不当，错误递减iod并释放了未分配的地址，导致无效释放，可能引发内核崩溃或内存破坏。

AI Predicted 5.6 Difficulty: Hard EPSS 0.19% · P9

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux c53432030d86429dc9fe5adc3d68cb9d1343b0b2< b189c6e408896ccc23d2e76d7738847cdebf1532 affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< 449e9c4f8db84ad9d9bb288029b230bcf590faa2 affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< 1a8f007faefe8c226ec65896589f8d59b0a8d5a5 affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< d094582cce9c08516d714e7436a8f3b9211dda90 affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< 371fb1bf902adaa59be32bd7e904a5317e604fd0 affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< 8bce9cd08aae4283badf8ddc11fbb6f57b75a81e affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< bb9489f0dce58da730d3479588d6710d7a2c1b45 affected
c53432030d86429dc9fe5adc3d68cb9d1343b0b2< 94334ea92f4d7535f66f86e33681efa94827eddc affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80790

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvmet-fc: fix invalid free in LS IOD error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmet_fc_alloc_ls_iodlist() advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start of the array. The final kfree(iod) therefore frees an address before the allocated object. This can be reproduced with nvme-fcloop and failslab by setting fail-nth to 6 before creating a target port. KASAN reports: BUG: KASAN: invalid-free in nvmet_fc_register_targetport Free of addr ffff88816cf8ff48 by task nvmet_fail_nth/9552 Free the original allocation base stored in tgtport->iod instead. With this fix applied, the same sysfs write with fail-nth=6 returns -ENOMEM without any KASAN report.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于drivers/nvme/target/fc.c文件中nvmet_fc_alloc_ls_iodlist()函数在rqstbuf分配或响应缓冲区DMA映射失败时的错误路径处理不当，错误递减iod并释放了未分配的地址，导致无效释放，可能引发内核崩溃或内存破坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c53432030d86429dc9fe5adc3d68cb9d1343b0b2 ~ b189c6e408896ccc23d2e76d7738847cdebf1532 -
Linux Linux 4.10 -

II. Public POCs for CVE-2026-80790

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80790

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80790 (9)

Same Patch Batch · Linux · 2026-09-04 · 156 CVEs total

CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms
CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure
CVE-2026-80857 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
CVE-2026-80858 fuse: publish io-uring queues with release semantics
CVE-2026-80859 fuse: fix missing barrier when checking io-uring readiness
CVE-2026-80860 fuse: fix race between interrupt and resend
CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible
CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache
CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
CVE-2026-80874 arm64: dts: renesas: ironhide: Describe inline ECC carveouts
CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind
CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface
CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page
CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()
CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
CVE-2026-80855 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80790

No comments yet

Leave a comment