CVE-2026-80821 nvmet: pci-epf: put CQ ref on create_cq mapping failure
A remote PCI host can cause a memory leak and controller reference leak in the Linux kernel NVMe PCI endpoint function driver by triggering mapping failures during completion queue creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80821?
CVE-2026-80821 is a denial of service vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet: pci-epf: put CQ ref on create_cq mapping failure
nvmet_pci_epf_create_cq() calls nvmet_cq_create(), which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or returns a too-small partial mapping, the function jumps to err_internal / err_unmap_queue without calling nvmet_cq_put(). The matching put in nvmet_pci_epf_delete_cq() is gated on NVMET_PCI_EPF_Q_LIVE, which is only set after the mapping succeeds, so teardown never releases these references. A remote PCI host that drives Create IO CQ commands with a failing PRP1/pci_addr therefore leaks the CQ and a controller reference on each attempt.
Drop the CQ reference on the mapping-failure paths. The err_internal and err_unmap_queue labels are only reachable after nvmet_cq_create() has succeeded, so this pairs the create/put correctly.
Which versions are affected by CVE-2026-80821?
How do I fix CVE-2026-80821?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80821 being exploited?
There is no known exploitation of CVE-2026-80821 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80821, DEBIAN-CVE-2026-80821, GHSA-xgj8-pp4r-hmxg, UBUNTU-CVE-2026-80821.