{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "61c9967cd63448292a64f9ee9aeb6e2053e3a624"
            },
            {
              "fixed": "61dc1a37e04d4003a19095f54883358330034a39"
            },
            {
              "fixed": "2bc1e33ff6a558c8ceef7c0077f3ef70a15fcba2"
            },
            {
              "fixed": "123d664ac98d6f3464462ad4a530474b91ba9890"
            },
            {
              "fixed": "79aba4c9403419d822972d2851f2a96a2c0531cf"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.47"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "7.2.0"
            },
            {
              "fixed": "7.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80813.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()\n\nWhen a host issues an Identify command with CNS 07h (Active Namespace ID\nList for a specific I/O Command Set), nvmet_execute_identify_nslist() is\ncalled with match_css set. The command-set filter dereferences req-\u003ens,\nbut this handler never calls nvmet_req_find_ns(), so req-\u003ens is always\nNULL (nvmet_req_init() resets it to NULL). As soon as an enabled\nnamespace with an NSID greater than the requested value exists,\nreq-\u003ens-\u003ecsi dereferences a NULL pointer and oopses.\n\nBesides the crash, the comparison is logically wrong: to filter the list\nby command set it must test the command set of the namespace being\niterated, not a single fixed value. Use the loop variable ns-\u003ecsi.",
  "id": "CVE-2026-80813",
  "modified": "2026-09-06T03:30:44.453725404Z",
  "published": "2026-09-04T15:13:33.761Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/123d664ac98d6f3464462ad4a530474b91ba9890"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2bc1e33ff6a558c8ceef7c0077f3ef70a15fcba2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/61dc1a37e04d4003a19095f54883358330034a39"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79aba4c9403419d822972d2851f2a96a2c0531cf"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80813.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80813"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()"
}