CVE-2026-98724 Overview
CVE-2026-98724 is an out-of-bounds read vulnerability in the Linux kernel's NVMe target (nvmet) PCI endpoint function (pci-epf) driver. The host controls the length of a Scatter Gather List (SGL) segment. When the host supplies a nonzero length smaller than one SGL descriptor, the nr_descs value becomes zero. The function nvmet_pci_epf_get_sgl_segment() then reads the type byte of sgls[-1] outside the allocated buffer. If that out-of-bounds byte matches a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count. The issue was reliably reproduced under KASAN using a KUnit test harness.
Critical Impact
A malicious or compromised PCIe host can trigger a kernel slab out-of-bounds read in the NVMe target endpoint, leading to information disclosure or kernel panic when panic_on_warn is set.
Affected Products
- Linux kernel builds that include the nvmet PCI endpoint function target driver
- Systems acting as NVMe targets over PCI endpoint framework
- Distributions tracking mainline before the referenced stable fixes
Discovery Timeline
- 2026-10-18 - CVE-2026-98724 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98724
Vulnerability Analysis
The nvmet PCI endpoint target processes SGL segments supplied by the remote NVMe host. Each SGL descriptor is 16 bytes. The driver computes nr_descs by dividing the segment length by the descriptor size. When the host passes a nonzero length under 16 bytes, integer truncation produces nr_descs = 0.
The function nvmet_pci_epf_get_sgl_segment() then dereferences sgls[nr_descs - 1], which resolves to sgls[-1]. This read lands outside the allocated buffer and reaches adjacent slab memory. KASAN reports confirm the primitive triggers in 3 of 3 boots when exercised through the KUnit test nvmet_pci_epf_short_sgl_test.
If the out-of-bounds byte happens to encode a segment descriptor type, control flow continues and the driver copies the preceding 16 bytes into controller-visible memory. The function then returns a negative descriptor count, which downstream logic is not prepared to handle.
Root Cause
The driver trusted a host-controlled length field without validating that the segment can hold at least one SGL descriptor. Classified as an Out-of-Bounds Read [CWE-125] with contributing improper input validation on the untrusted host-supplied size.
Attack Vector
An attacker with the ability to issue NVMe commands against the PCI endpoint target can craft an SGL segment with a length between 1 and 15 bytes. Processing this segment triggers the out-of-bounds read, enabling adjacent slab memory disclosure or a kernel panic when panic_on_warn is configured.
No verified public exploit code is available. Technical details are documented in the upstream fix commits: Linux Kernel Commit 2423a05, Linux Kernel Commit 472df1d, and Linux Kernel Commit 5d5fbfb.
Detection Methods for CVE-2026-98724
Indicators of Compromise
- KASAN report containing BUG: KASAN: slab-out-of-bounds in nvmet_pci_epf_get_sgl_segment in kernel logs.
- Unexpected kernel panics referencing nvmet_pci_epf on systems configured as NVMe PCI endpoint targets.
- Negative descriptor counts or malformed SGL processing errors emitted by the nvmet subsystem.
Detection Strategies
- Deploy KASAN-enabled test kernels in staging to surface the exact fault signature from the upstream reproducer.
- Monitor dmesg and journald for nvmet_pci_epf_get_sgl_segment call-trace entries.
- Correlate crash dumps with NVMe target workloads to identify repeatable host-triggered faults.
Monitoring Recommendations
- Centralize kernel ring buffer and kdump output for all hosts running the nvmet-pci-epf module.
- Alert on repeated nvmet warnings or oops events, which may indicate probing by a compromised host.
- Track module load events for nvmet_pci_epf to inventory exposed targets.
How to Mitigate CVE-2026-98724
Immediate Actions Required
- Apply the upstream stable kernel fixes referenced below as soon as vendor packages become available.
- Unload the nvmet_pci_epf module on systems that do not require NVMe-over-PCI endpoint functionality.
- Restrict physical and logical access to PCIe hosts that connect to systems acting as NVMe targets.
Patch Information
The upstream fix rejects SGL segments that cannot hold at least one 16-byte descriptor before allocation or transfer. Patches are available in Linux Kernel Commit 2423a05, Linux Kernel Commit 472df1d, and Linux Kernel Commit 5d5fbfb. Rebuild and reboot into a patched kernel to activate the fix.
Workarounds
- Disable the NVMe target PCI endpoint function when it is not in active use by blacklisting nvmet_pci_epf.
- Limit the trust boundary of the PCIe host by ensuring only verified, controlled initiators can issue NVMe commands.
- Disable panic_on_warn where operational policy allows, to prevent an out-of-bounds read from escalating to a full kernel panic while patches are staged.
# Prevent the vulnerable module from loading until a patched kernel is deployed
echo "blacklist nvmet_pci_epf" | sudo tee /etc/modprobe.d/cve-2026-98724.conf
sudo rmmod nvmet_pci_epf 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
