CVE-2026-98724 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
nvmet: pci-epf: reject too-short SGL segments
The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside
the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.
The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test:
BUG: KASAN: slab-out-of-bounds in nvmet_pci_epf_get_sgl_segment Read of size 1 by task kunit_try_catch Call Trace: nvmet_pci_epf_get_sgl_segment nvmet_pci_epf_short_sgl_test Kernel panic - not syncing: KASAN: panic_on_warn set ...
Reject segments that cannot hold one descriptor before allocating or transferring their contents.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's NVMe target subsystem contains a critical out-of-bounds read vulnerability within the pci-epf driver, specifically in the function nvmet_pci_epf_get_sgl_segment. This flaw arises from insufficient validation of Scatter-Gather List (SGL) segment lengths provided by the host system. In NVMe over Fabrics and related protocols, SGLs are used to describe memory buffers for data transfers. The length of each segment is controlled entirely by the remote host, which introduces a trust boundary that must be strictly enforced on the receiving end. When a host submits an SGL segment with a nonzero length that is smaller than the size required for a single descriptor structure, the internal calculation determines zero descriptors are present in that segment. Consequently, subsequent logic attempts to access memory at index -1 of the sgls array, resulting in a read operation outside the bounds of the allocated buffer.
This vulnerability represents an out-of-bounds read error where the kernel accesses invalid memory locations based on malformed input data. The technical consequence is severe because if the byte located just before the valid buffer boundary happens to contain a value interpreted as a segment descriptor type, the function proceeds to copy additional preceding bytes into its internal structures and returns a negative descriptor count. This behavior can lead to unpredictable system states, potential information disclosure of kernel memory contents, or immediate stability failures. The issue was successfully reproduced using Kernel Address Sanitizer (KASAN) during testing with mocked host transfers, confirming that the out-of-bounds read triggers a slab-out-of-bounds error and results in a kernel panic when warnings are treated as fatal errors.
From a security classification perspective, this vulnerability aligns with CWE-125, which defines Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. It also relates to CWE-20, Improper Input Validation, as the root cause is the failure to validate that incoming segment lengths meet minimum structural requirements before processing. In terms of attack vectors, this could be exploited by a malicious host connected via NVMe over Fabrics to trigger memory corruption or denial-of-service conditions against the target system. The ATT&CK framework categorizes such behaviors under techniques involving resource manipulation and potential privilege escalation if combined with other vulnerabilities, though primarily it serves as a Denial of Service vector in this context due to the kernel panic outcome.
The operational impact of this vulnerability includes service disruption through kernel panics, which effectively crash the NVMe target subsystem or the entire host system depending on configuration settings like panic_on_warn. For enterprise environments relying on high-availability storage solutions, such instability poses a significant risk to data integrity and availability. Furthermore, while primarily an out-of-bounds read, improper handling of negative descriptor counts could potentially lead to further logic errors in subsequent processing stages if not properly mitigated by the fix.
To mitigate this vulnerability, system administrators must apply kernel updates that include the patch rejecting SGL segments with lengths too short to hold at least one descriptor. This validation ensures that before any memory allocation or data transfer operations occur, the segment length is verified against the minimum size required for a valid NVMe SGL descriptor structure. By enforcing this constraint early in the processing pipeline, the kernel prevents access to invalid memory addresses and avoids the subsequent copy operations that rely on potentially corrupted index calculations. Regular patching of Linux kernels is essential to maintain security posture against such protocol-level exploitation attempts targeting storage subsystems.