Cloudanix VulnDB

CVE-2026-98964

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling mistake in the Linux kernel can let a remote attacker crash storage servers that use certain high-speed connections.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

In nvmet_req_alloc_p2pmem_sgls the req->p2p_dev pointer is assigned only after both data and metadata SGL allocations succeed; a failure in the metadata path after a successful data allocation causes the still-uninitialized req->p2p_dev to be passed to pci_p2pmem_free_sgl, resulting in a use-after-free or invalid-device dereference.

Why it matters to the business

Systems acting as NVMe-oF targets that enable peer-to-peer memory may suffer kernel crashes or service outages when allocation pressure triggers the failure path, interrupting storage access for clients.

How an attack unfolds

An attacker connected to an nvmet target issues NVMe commands crafted to succeed the data SGL allocation while forcing the subsequent metadata allocation to fail, causing the cleanup routine to operate on an unassigned p2p_dev pointer.

How to fix it

Apply the upstream kernel patch that passes the local p2p_dev argument to pci_p2pmem_free_sgl instead of the unassigned req->p2p_dev field; rebuild and deploy the fixed kernel on all affected NVMe-oF target systems.

How to confirm the fix worked

Inspect the patched nvmet_req_alloc_p2pmem_sgls function to confirm the local p2p_dev variable is supplied to the free routine on every error path; re-run allocation-failure test cases to verify no invalid pointer is dereferenced.

Typical attack path

  1. Establish an NVMe-oF connection to the target
  2. Send commands that exercise the P2P SGL allocation path
  3. Force a metadata allocation failure after data allocation succeeds
  4. Trigger pci_p2pmem_free_sgl on the uninitialized pointer
  5. Induce kernel panic or memory corruption

How to detect it

Review kernel logs for oops or panic messages referencing pci_p2pmem_free_sgl or nvmet SGL allocation; correlate unexpected reboots of storage target systems with periods of high allocation contention.

What your security team should do

  • Prioritize kernel updates on all NVMe-oF target hosts within the next maintenance window
  • Disable P2P memory usage for nvmet if immediate patching is not feasible
  • Monitor vendor advisories for backported fixes in supported distributions

The record

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails, out_free_sg passes req->p2p_dev to pci_p2pmem_free_sgl() before that assignment has taken place. Pass the local p2p_dev argument instead, so cleanup uses the same PCI device as the successful data allocation.

Affected packages

Ecosystem Package Introduced Fixed