CVE-2026-80821
CVE CVE-2026-80821EUVD EUVD-2026-71263Published 2026-09-04T15:27:42.000ZLast changed 2026-09-04T15:29:15.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on create_cq mapping failure nvmet_pci_epf_create_cq() calls nvmet_cq_create(), which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or returns a too-small partial mapping, the function jumps to err_internal / err_unmap_queue without calling nvmet_cq_put(). The matching put in nvmet_pci_epf_delete_cq() is gated on NVMET_PCI_EPF_Q_LIVE, which is only set after the mapping succeeds, so teardown never releases these references. A remote PCI host that drives Create IO CQ commands with a failing PRP1/pci_addr therefore leaks the CQ and a controller reference on each attempt. Drop the CQ reference on the mapping-failure paths. The err_internal and err_unmap_queue labels are only reachable after nvmet_cq_create() has succeeded, so this pairs the create/put correctly.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 6.14; 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186 <b5f97fae2503a763fa0f953abf5f121b0fef7d0d; patch: 7.2.1; patch: 7.3-rc1; 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186 <659ae9d02cb5d72c76f74fff7441eb8fb64d8f5c; patch: 7.1.11; patch: 6.18.47; patch: 0; 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186 <56a7b6a6880dbabe28214ff88df8d229ca3a944a; 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186 <f31650243c1ab32394077f234685e89ed8dece84
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.