Linux Kernel up to 7.2.5 nvmet nvmet_execute_get_log_page_rmi allocation of resources

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2.5. The impacted element is the function nvmet_execute_get_log_page_rmi of the component nvmet. This manipulation causes allocation of resources. This vulnerability appears as CVE-2026-90412. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in Linux Kernel up to 7.2.5. Affected by this vulnerability is the function nvmet_execute_get_log_page_rmi of the component nvmet. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS (set by the successful nvmet_req_find_ns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred. Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler, so an allocation failure is reported as an internal error.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2026-90412 since 09/11/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 9e136150ac55df4b7ea36e6110ffa39d08905f37/581d8bb556dd3e5567bcf322aa5e3e4b6a200c08 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion