CVE-2026-98724
Received Received - Intake

Buffer Overflow in Linux Kernel NVMe-oF Target

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count. The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test: BUG: KASAN: slab-out-of-bounds in nvmet_pci_epf_get_sgl_segment Read of size 1 by task kunit_try_catch Call Trace: nvmet_pci_epf_get_sgl_segment nvmet_pci_epf_short_sgl_test Kernel panic - not syncing: KASAN: panic_on_warn set ... Reject segments that cannot hold one descriptor before allocating or transferring their contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98724
EUVD
EUVD-2026-103809

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186
Linux Linux 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186
Linux Linux 0faa0fe6f90ea59b10d1b0f15ce0eb0c18eff186
Linux Linux 6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of SGL segments in the NVMe over Fabrics target (nvmet) PCI endpoint function (pci-epf). A host-controlled segment length smaller than one SGL descriptor causes the function to read outside the allocated buffer, potentially leading to a slab-out-of-bounds read and kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe target subsystem and requires kernel-level detection. There are no direct network commands to detect it. Check kernel logs for KASAN errors or crashes related to nvmet_pci_epf_get_sgl_segment. Use dmesg or journalctl to review kernel messages for slab-out-of-bounds errors or panic logs.

Impact Analysis

This vulnerability could cause system crashes (kernel panic) if exploited, leading to denial of service. It may also allow unauthorized memory access, potentially enabling privilege escalation or information disclosure in affected systems.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this vulnerability. If updating is not immediately possible, disable the NVMe target subsystem (CONFIG_NVME_TARGET_PCI) if not in use. Monitor kernel security advisories for further updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart