UBUNTU-CVE-2026-98723: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pcrefs Commit 6202783184bf ("nvmet: Improve nvmetallocctrl() interface and implementation") added a second uuidcopy() of args->hostid near the end of nvmetallocctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuidcopy") removed the original copy that sat before nvmetctrlinitpr() instead of the new one. Since then nvmetctrlinitpr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuidcopy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pcref created on this path stores the nil UUID. pcref->hostid has a single consumer: nvmetprsetctrltoabort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmetctrlinitpr() takes its snapshot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
In the Linux kernel nvmet connection path, copy args->hostid into ctrl->hostid before nvmet_ctrl_init_pr() takes its snapshot and before the controller is published, so per-controller reservation references store the connecting host's UUID.
Event History
Frequently Asked Questions
Which deployments are affected in practice?
The issue affects NVMe target deployments that use persistent reservations and perform Preempt and Abort operations. It occurs when a namespace with reservations enabled exists before a host connects, including reconnect scenarios.
What is the operational impact of triggering the condition?
Preempt and Abort silently behaves like a plain Preempt. The preempting host receives success, but the preempted host's in-flight I/O is not killed and drained as intended.
How can administrators recognize the issue?
A likely indicator is a successful Preempt and Abort operation followed by continued in-flight I/O from the host that was supposed to be aborted. Internally, the per-controller reservation reference stores a nil UUID, preventing the host ID match needed to abort that controller's I/O.