CVE-2026-98724: nvmet: pci-epf: reject too-short SGL segments
In the Linux kernel, the following vulnerability has been resolved:
nvmet: pci-epf: reject too-short SGL segments
The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment() reads the type byte of sgls[-1] outside the allocated buffer. If that byte contains a segment descriptor type, the function also copies the preceding 16 bytes and returns a negative descriptor count.
The read was reproduced in 3/3 KASAN boots with only the host transfer mocked by a KUnit test:
BUG: KASAN: slab-out-of-bounds in nvmetpciepfgetsglsegment Read of size 1 by task kunittrycatch Call Trace: nvmetpciepfgetsglsegment nvmetpciepfshortsgltest Kernel panic - not syncing: KASAN: paniconwarn set ...
Reject segments that cannot hold one descriptor before allocating or transferring their contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject SGL segments that cannot hold one descriptor before allocating or transferring their contents; specifically reject a segment when its length is too short to contain one descriptor.