CVE-2026-98723

Received Received - Intake

Memory Corruption in Linux Kernel NVMe Target

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one. Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID. pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98723

EUVD

EUVD-2026-103977

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	7b658153f1b8a79ed98980f2fef7b92a66aeb9cd
Linux	Linux	7b658153f1b8a79ed98980f2fef7b92a66aeb9cd
Linux	Linux	7b658153f1b8a79ed98980f2fef7b92a66aeb9cd
Linux	Linux	6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing host ID copy during controller initialization in the NVMe Target subsystem. The issue occurs when the host ID is not properly copied before creating per-namespace reservation references, leading to nil UUIDs being stored. This causes Preempt and Abort commands to fail silently, degrading security and data integrity during host reconnects.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe Target (nvmet) subsystem and may not have direct network detection commands. Check kernel logs for NVMe Target errors or failures during controller initialization or namespace operations. Look for messages related to reservation handling or hostid mismatches.

Impact Analysis

If you use systems with NVMe storage and reservations enabled, this flaw could allow unauthorized hosts to bypass proper preemption and abort operations. This may result in data corruption, loss of access control, or unexpected behavior during storage operations, particularly during reconnects or failovers.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to Linux kernel NVMe target functionality. The issue involves incorrect handling of host IDs in reservation references, which could lead to data integrity problems during preempt and abort operations but does not explicitly violate privacy or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this issue. Monitor for NVMe Target errors in system logs. If using NVMe over Fabrics with reservations, verify reservation operations function correctly after patching.

Hi! I’m here to help you understand CVE-2026-98723. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70