CVE-2026-90412: nvmet: fix return status of RMI log page on allocation failure
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix return status of RMI log page on allocation failure
nvmetexecutegetlogpagermi() leaves 'status' holding NVMESCSUCCESS (set by the successful nvmetreqfindns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred.
Initialize 'status' to NVMESCINTERNAL, matching the smart log handler, so an allocation failure is reported as an internal error.
Event History
Frequently Asked Questions
When does the incorrect success response occur?
It occurs when handling an RMI log page request after namespace lookup succeeds but allocation of the log buffer with kzalloc() fails. The request is then completed with NVME_SC_SUCCESS even though no log data was transferred.
What is the practical impact for an NVMe host?
A host can be told that its RMI log page command succeeded despite receiving no data because the target could not allocate the required buffer. This can cause the host to treat an unsuccessful log retrieval as successful.
How is the issue corrected?
The fix initializes the request status to NVME_SC_INTERNAL so that a log-buffer allocation failure is returned to the host as an internal error rather than as success.