Vulnerability in nvme-pci: NULL pointer dereference in nvme_alloc_admin_tags

Kernel Updated 02 Oct 2025

Summary

28/06/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1003991: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags. Affects Kernel versions < 9e649471b396fa0139d53919354ce1eace9b9a24. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The nvme-pci package is a component of the Linux Kernel ecosystem. It provides support for NVMe (Non-Volatile Memory Express) devices connected via PCI. NVMe is a protocol designed for efficient communication between host systems and solid-state drives (SSDs). The nvme-pci package handles the administration and management of NVMe devices through the PCI interface.

Vulnerability Detail

The vulnerability identified as GSD-2022-1003991 in the nvme-pci package involves a NULL pointer dereference in the nvme_alloc_admin_tags function. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition, potentially leading to system instability or crashes. The issue arises when the nvme_alloc_admin_tags function fails to handle a NULL pointer properly, resulting in a crash if the function is called with a NULL pointer as an argument. The impact and attack plausibility of this vulnerability have not been proven yet.

How To Fix

No fixed version is published for this vulnerability.

To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.283 or later. The fix for this issue can be found in commit 9e649471b396fa0139d53919354ce1eace9b9a24 of the Linux Kernel repository. Updating the kernel to the fixed version will ensure that the NULL pointer dereference is properly handled in the nvme_alloc_admin_tags function.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Conclusion

In conclusion, the nvme-pci package in the Linux Kernel is vulnerable to a NULL pointer dereference in the nvme_alloc_admin_tags function. This vulnerability can potentially lead to system instability or crashes. To mitigate the risk, it is recommended to update the Linux Kernel to version v4.14.283 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for Kernel →