CVE-2026-98724: nvmet: pci-epf: reject too-short SGL segments
In the Linux kernel, the following vulnerability has been resolved:
nvmet: pci-epf: reject too-short SGL segments
The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.
The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test:
BUG: KASAN: slab-out-of-bounds in nvmetpciepfgetsglsegment Read of size 1 by task kunittrycatch Call Trace: nvmetpciepfgetsglsegment nvmetpciepfshortsgltest Kernel panic - not syncing: KASAN: paniconwarn set ...
Reject segments that cannot hold one descriptor before allocating or transferring their contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In nvmet PCI endpoint function SGL handling, reject SGL segments that cannot hold at least one descriptor before allocating a buffer or transferring the segment contents.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel nvmet PCI endpoint function path are exposed when they process host-supplied SGL segments. The vulnerable condition is reached through an SGL segment provided by the host.
What does an attacker need to trigger the out-of-bounds read?
The host must provide an SGL segment with a nonzero length that is smaller than one SGL descriptor. This causes the descriptor count to become zero and can make the function read a type byte before the allocated SGL buffer.
How can I identify signs that this condition has occurred?
A KASAN-enabled kernel can report a slab-out-of-bounds read in nvmet_pci_epf_get_sgl_segment. The reported reproduction included a KASAN panic when panic_on_warn was set.
What is the available remediation?
Apply a kernel update containing the referenced fixes. The fix rejects SGL segments that cannot contain at least one descriptor before allocating or transferring their contents.