nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-22998
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-01-25 15:15:54 UTC
Updated2026-04-27 14:16:28 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected f775f2621c2ac5cc3a0b3a64665dad4fb146e510 baabe43a0edefac8cd7b981ff87f967f6034dafe git Not specified
CNA Linux Linux affected 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d 76abc83a9d25593c2b7613c549413079c14a4686 git Not specified
CNA Linux Linux affected 2871aa407007f6f531fae181ad252486e022df42 7d75570002929d20e40110d6b03e46202c9d1bc7 git Not specified
CNA Linux Linux affected 24e05760186dc070d3db190ca61efdbce23afc88 fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4 git Not specified
CNA Linux Linux affected efa56305908ba20de2104f1b8508c6a7401833be 3def5243150716be86599c2a1767c29c68838b6d git Not specified
CNA Linux Linux affected efa56305908ba20de2104f1b8508c6a7401833be 374b095e265fa27465f34780e0eb162ff1bef913 git Not specified
CNA Linux Linux affected efa56305908ba20de2104f1b8508c6a7401833be 32b63acd78f577b332d976aa06b56e70d054cbba git Not specified
CNA Linux Linux affected ee5e7632e981673f42a50ade25e71e612e543d9d git Not specified
CNA Linux Linux affected 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 git Not specified
CNA Linux Linux affected 6.8 Not specified
CNA Linux Linux unaffected 6.8 semver Not specified
CNA Linux Linux unaffected 5.10.249 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.199 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.162 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.122 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.67 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.7 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/32b63acd78f577b332d976aa06b56e70d054cbba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/baabe43a0edefac8cd7b981ff87f967f6034dafe 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7d75570002929d20e40110d6b03e46202c9d1bc7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/3def5243150716be86599c2a1767c29c68838b6d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/76abc83a9d25593c2b7613c549413079c14a4686 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/374b095e265fa27465f34780e0eb162ff1bef913 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report