CVE-2026-80821

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: pci-epf: put CQ ref on create_cq mapping failure

nvmet_pci_epf_create_cq() calls nvmet_cq_create(), which takes a

reference on the controller and installs the completion queue. If the

subsequent PCI address-space mapping fails or returns a too-small partial

mapping, the function jumps to err_internal / err_unmap_queue without

calling nvmet_cq_put(). The matching put in nvmet_pci_epf_delete_cq() is

gated on NVMET_PCI_EPF_Q_LIVE, which is only set after the mapping

succeeds, so teardown never releases these references. A remote PCI host

that drives Create IO CQ commands with a failing PRP1/pci_addr therefore

leaks the CQ and a controller reference on each attempt.

Drop the CQ reference on the mapping-failure paths. The err_internal and

err_unmap_queue labels are only reachable after nvmet_cq_create() has

succeeded, so this pairs the create/put correctly.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References