CVE-2026-89971 Linux Kernel NVMe - Denial of Service

Linux kernel NVMe subsystem contains a vulnerability in zone info update caused by improper handling of positive NVMe status codes in nvme_query_zone_info(), letting attackers cause invalid zone size processing and potential kernel errors, exploit requires a device or firmware that fails the Identify Namespace command.

CVSS base score 7.5 /10
High
CISA KEV
Not listed
Public exploit
None known
EPSS
0.60% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Denial of Service
Impact
Denial Of Service
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
16 September 2026
Updated
15 October 2026

Vendor fix

Update to the latest Linux kernel version containing the fix for nvme zone info update handling.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs