CVE-2026-80787

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()

nvmet_pci_epf_exec_iod_work() submits an I/O command with req->execute()

and then waits for the command to complete and transfers the data back

to the host. This wait is not needed for commands that do not transfer

data from the device to the host. To decide whether that wait is needed,

it reads iod->data_len and iod->dma_dir after calling req->execute().

However, once req->execute() is called, the command may complete

asynchronously on another CPU. For commands that do not require a

device-to-host data transfer, nvmet_pci_epf_queue_response() calls

nvmet_pci_epf_complete_iod() directly, which can free the iod before it

reads iod->data_len and iod->dma_dir, resulting in the KFENCE use-after-

free:

BUG: KFENCE: use-after-free read in nvmet_pci_epf_exec_iod_work+0x288/0x798 [nvmet_pci_epf]

Use-after-free read at 0x00000000fdfa6d03 (in kfence-#63):

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References