GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-22998 (GCVE-0-2026-22998)

Vulnerability from cvelistv5 – Published: 2026-01-25 14:36 – Updated: 2026-08-05 12:20
VLAI
Title
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 20:38 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f775f2621c2ac5cc3a0b3a64665dad4fb146e510 , < baabe43a0edefac8cd7b981ff87f967f6034dafe (git)
Affected: 4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d , < 76abc83a9d25593c2b7613c549413079c14a4686 (git)
Affected: 2871aa407007f6f531fae181ad252486e022df42 , < 7d75570002929d20e40110d6b03e46202c9d1bc7 (git)
Affected: 24e05760186dc070d3db190ca61efdbce23afc88 , < fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4 (git)
Affected: efa56305908ba20de2104f1b8508c6a7401833be , < 3def5243150716be86599c2a1767c29c68838b6d (git)
Affected: efa56305908ba20de2104f1b8508c6a7401833be , < 374b095e265fa27465f34780e0eb162ff1bef913 (git)
Affected: efa56305908ba20de2104f1b8508c6a7401833be , < 32b63acd78f577b332d976aa06b56e70d054cbba (git)
Affected: ee5e7632e981673f42a50ade25e71e612e543d9d (git)
Affected: 70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 (git)
Affected: 5.10.209 , < 5.10.249 (semver)
Affected: 5.15.148 , < 5.15.199 (semver)
Affected: 6.1.75 , < 6.1.162 (semver)
Affected: 6.6.14 , < 6.6.122 (semver)
Affected: 5.4.268 , < 5.5 (semver)
Affected: 6.7.2 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 5.10.249 , ≤ 5.10.* (semver)
Unaffected: 5.15.199 , ≤ 5.15.* (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.67 , ≤ 6.12.* (semver)
Unaffected: 6.18.7 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:38:02.086283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:38:12.309Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "baabe43a0edefac8cd7b981ff87f967f6034dafe",
              "status": "affected",
              "version": "f775f2621c2ac5cc3a0b3a64665dad4fb146e510",
              "versionType": "git"
            },
            {
              "lessThan": "76abc83a9d25593c2b7613c549413079c14a4686",
              "status": "affected",
              "version": "4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d",
              "versionType": "git"
            },
            {
              "lessThan": "7d75570002929d20e40110d6b03e46202c9d1bc7",
              "status": "affected",
              "version": "2871aa407007f6f531fae181ad252486e022df42",
              "versionType": "git"
            },
            {
              "lessThan": "fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4",
              "status": "affected",
              "version": "24e05760186dc070d3db190ca61efdbce23afc88",
              "versionType": "git"
            },
            {
              "lessThan": "3def5243150716be86599c2a1767c29c68838b6d",
              "status": "affected",
              "version": "efa56305908ba20de2104f1b8508c6a7401833be",
              "versionType": "git"
            },
            {
              "lessThan": "374b095e265fa27465f34780e0eb162ff1bef913",
              "status": "affected",
              "version": "efa56305908ba20de2104f1b8508c6a7401833be",
              "versionType": "git"
            },
            {
              "lessThan": "32b63acd78f577b332d976aa06b56e70d054cbba",
              "status": "affected",
              "version": "efa56305908ba20de2104f1b8508c6a7401833be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee5e7632e981673f42a50ade25e71e612e543d9d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.249",
              "status": "affected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.199",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.162",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.122",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "5.10.209",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.268",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec\n\nCommit efa56305908b (\"nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\")\nadded ttag bounds checking and data_offset\nvalidation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate\nwhether the command\u0027s data structures (cmd-\u003ereq.sg and cmd-\u003eiov) have\nbeen properly initialized before processing H2C_DATA PDUs.\n\nThe nvmet_tcp_build_pdu_iovec() function dereferences these pointers\nwithout NULL checks. This can be triggered by sending H2C_DATA PDU\nimmediately after the ICREQ/ICRESP handshake, before\nsending a CONNECT command or NVMe write command.\n\nAttack vectors that trigger NULL pointer dereferences:\n1. H2C_DATA PDU sent before CONNECT \u2192 both pointers NULL\n2. H2C_DATA PDU for READ command \u2192 cmd-\u003ereq.sg allocated, cmd-\u003eiov NULL\n3. H2C_DATA PDU for uninitialized command slot \u2192 both pointers NULL\n\nThe fix validates both cmd-\u003ereq.sg and cmd-\u003eiov before calling\nnvmet_tcp_build_pdu_iovec(). Both checks are required because:\n- Uninitialized commands: both NULL\n- READ commands: cmd-\u003ereq.sg allocated, cmd-\u003eiov NULL\n- WRITE commands: both allocated"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the NVMe over TCP target receive path and is reachable by sending NVMe/TCP PDUs to the target TCP listener. A remote peer can send ICREQ followed by malformed H2C_DATA over the network.\nAC:L - No race or hard-to-control state is required for the pre-CONNECT trigger; the attacker only needs to send a valid IC handshake and then an H2C_DATA PDU with coherent length fields. The required packet sequence is deterministic.\nPR:N - The simplest trigger occurs after ICREQ/ICRESP but before CONNECT, before host NQN allow-list checks, controller creation, or DH-HMAC-CHAP authentication are reached. Thus an unauthenticated network peer can reach the vulnerable handler on a non-TLS or plaintext-accepted target port.\nUI:N - Exploitation does not require any victim user action after the target service is listening. The attacker sends protocol messages directly to the NVMe/TCP target.\nS:U - The impact is within the vulnerable kernel/target system\u2019s own security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:N - The bug is a NULL pointer dereference of uninitialized command buffers, not an out-of-bounds read or use-after-free. The investigated paths support a crash impact, not disclosure of kernel memory.\nI:N - The dereferences are to NULL command buffer pointers and do not provide a practical arbitrary write or control-flow primitive. The fix and related history characterize the issue as invalid state leading to NULL dereference.\nA:H - The vulnerable dereference occurs in kernel context and can produce an oops or panic in the nvmet-tcp workqueue path. Repeated unauthenticated network triggers can deny availability of the target system or service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:02.379Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/baabe43a0edefac8cd7b981ff87f967f6034dafe"
        },
        {
          "url": "https://git.kernel.org/stable/c/76abc83a9d25593c2b7613c549413079c14a4686"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d75570002929d20e40110d6b03e46202c9d1bc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3def5243150716be86599c2a1767c29c68838b6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/374b095e265fa27465f34780e0eb162ff1bef913"
        },
        {
          "url": "https://git.kernel.org/stable/c/32b63acd78f577b332d976aa06b56e70d054cbba"
        }
      ],
      "title": "nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-22998",
    "datePublished": "2026-01-25T14:36:12.935Z",
    "dateReserved": "2026-01-13T15:37:45.938Z",
    "dateUpdated": "2026-08-05T12:20:02.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-22998",
      "date": "2026-09-19",
      "epss": "0.00739",
      "percentile": "0.53081"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-03T14:36:56.000Z",
      "cve": "CVE-2026-22998",
      "id": "msrc_CVE-2026-22998",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-22998.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "baabe43a0edefac8cd7b981ff87f967f6034dafe",
                    "status": "affected",
                    "version": "f775f2621c2ac5cc3a0b3a64665dad4fb146e510",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "76abc83a9d25593c2b7613c549413079c14a4686",
                    "status": "affected",
                    "version": "4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d75570002929d20e40110d6b03e46202c9d1bc7",
                    "status": "affected",
                    "version": "2871aa407007f6f531fae181ad252486e022df42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4",
                    "status": "affected",
                    "version": "24e05760186dc070d3db190ca61efdbce23afc88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3def5243150716be86599c2a1767c29c68838b6d",
                    "status": "affected",
                    "version": "efa56305908ba20de2104f1b8508c6a7401833be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "374b095e265fa27465f34780e0eb162ff1bef913",
                    "status": "affected",
                    "version": "efa56305908ba20de2104f1b8508c6a7401833be",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32b63acd78f577b332d976aa06b56e70d054cbba",
                    "status": "affected",
                    "version": "efa56305908ba20de2104f1b8508c6a7401833be",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ee5e7632e981673f42a50ade25e71e612e543d9d",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.249",
                    "status": "affected",
                    "version": "5.10.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.199",
                    "status": "affected",
                    "version": "5.15.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.162",
                    "status": "affected",
                    "version": "6.1.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.122",
                    "status": "affected",
                    "version": "6.6.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.268",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "affected",
                    "version": "6.7.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/target/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.249",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.199",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.162",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.122",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.67",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2E4BEAC0-E873-440D-A75E-55699C2412A4",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.268",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6983E9C-F8A9-4494-8156-3E2F7E736BF8",
                    "versionEndExcluding": "5.10.249",
                    "versionStartIncluding": "5.10.209",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0275B58-DF8C-46AE-B9A5-20396D123D12",
                    "versionEndExcluding": "5.15.199",
                    "versionStartIncluding": "5.15.148",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9DE91ACC-6DAF-42AE-8D41-3A91572E9052",
                    "versionEndExcluding": "6.1.162",
                    "versionStartIncluding": "6.1.75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "68AE0BF9-0835-45D8-AACC-EDFAC1663259",
                    "versionEndExcluding": "6.6.122",
                    "versionStartIncluding": "6.6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2B14F508-4490-4A35-BEFC-40EF300279E7",
                    "versionEndExcluding": "6.12.67",
                    "versionStartIncluding": "6.7.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "99FF3E05-0E7A-44E9-8E47-BF6F1F8EC436",
                    "versionEndExcluding": "6.18.7",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec\n\nCommit efa56305908b (\"nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\")\nadded ttag bounds checking and data_offset\nvalidation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate\nwhether the command\u0027s data structures (cmd-\u003ereq.sg and cmd-\u003eiov) have\nbeen properly initialized before processing H2C_DATA PDUs.\n\nThe nvmet_tcp_build_pdu_iovec() function dereferences these pointers\nwithout NULL checks. This can be triggered by sending H2C_DATA PDU\nimmediately after the ICREQ/ICRESP handshake, before\nsending a CONNECT command or NVMe write command.\n\nAttack vectors that trigger NULL pointer dereferences:\n1. H2C_DATA PDU sent before CONNECT \u2192 both pointers NULL\n2. H2C_DATA PDU for READ command \u2192 cmd-\u003ereq.sg allocated, cmd-\u003eiov NULL\n3. H2C_DATA PDU for uninitialized command slot \u2192 both pointers NULL\n\nThe fix validates both cmd-\u003ereq.sg and cmd-\u003eiov before calling\nnvmet_tcp_build_pdu_iovec(). Both checks are required because:\n- Uninitialized commands: both NULL\n- READ commands: cmd-\u003ereq.sg allocated, cmd-\u003eiov NULL\n- WRITE commands: both allocated"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvme-tcp: soluciona desreferencias de puntero NULL en nvmet_tcp_build_pdu_iovec\n\nEl commit efa56305908b (\u0027nvmet-tcp: Soluciona un p\u00e1nico del kernel cuando el host env\u00eda una longitud de PDU H2C inv\u00e1lida\u0027) a\u00f1adi\u00f3 la comprobaci\u00f3n de l\u00edmites de ttag y la validaci\u00f3n de data_offset en nvmet_tcp_handle_h2c_data_pdu(), pero no valid\u00f3 si las estructuras de datos del comando (cmd-\u0026gt;req.sg y cmd-\u0026gt;iov) han sido inicializadas correctamente antes de procesar las PDUs H2C_DATA.\n\nLa funci\u00f3n nvmet_tcp_build_pdu_iovec() desreferencia estos punteros sin comprobaciones de NULL. Esto puede ser provocado enviando una PDU H2C_DATA inmediatamente despu\u00e9s del handshake ICREQ/ICRESP, antes de enviar un comando CONNECT o un comando de escritura NVMe.\n\nVectores de ataque que provocan desreferencias de puntero NULL:\n1. PDU H2C_DATA enviada antes de CONNECT ? ambos punteros NULL\n2. PDU H2C_DATA para comando READ ? cmd-\u0026gt;req.sg asignado, cmd-\u0026gt;iov NULL\n3. PDU H2C_DATA para slot de comando no inicializado ? ambos punteros NULL\n\nLa soluci\u00f3n valida tanto cmd-\u0026gt;req.sg como cmd-\u0026gt;iov antes de llamar a nvmet_tcp_build_pdu_iovec(). Ambas comprobaciones son necesarias porque:\n- Comandos no inicializados: ambos NULL\n- Comandos READ: cmd-\u0026gt;req.sg asignado, cmd-\u0026gt;iov NULL\n- Comandos WRITE: ambos asignados"
          }
        ],
        "id": "CVE-2026-22998",
        "lastModified": "2026-06-17T13:20:10.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-22998",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:38:02.086283Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-25T15:15:54.643",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/32b63acd78f577b332d976aa06b56e70d054cbba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/374b095e265fa27465f34780e0eb162ff1bef913"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3def5243150716be86599c2a1767c29c68838b6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/76abc83a9d25593c2b7613c549413079c14a4686"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7d75570002929d20e40110d6b03e46202c9d1bc7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/baabe43a0edefac8cd7b981ff87f967f6034dafe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-12T02:31:50+00:00",
      "cve": "CVE-2026-22998",
      "id": "CVE-2026-22998",
      "initial_release_date": "2026-01-25T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22998.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:27:20Z",
      "cve": "CVE-2026-22998",
      "id": "CVE-2026-22998",
      "initial_release_date": "2026-01-26T00:24:49Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "569",
      "product_status:known_not_affected": "51",
      "product_status:recommended": "421",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-22998",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-22998.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-22998",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T20:38:02.086283Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T20:38:07.832Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/nvme/target/tcp.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "baabe43a0edefac8cd7b981ff87f967f6034dafe",
                  "status": "affected",
                  "version": "f775f2621c2ac5cc3a0b3a64665dad4fb146e510",
                  "versionType": "git"
                },
                {
                  "lessThan": "76abc83a9d25593c2b7613c549413079c14a4686",
                  "status": "affected",
                  "version": "4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d",
                  "versionType": "git"
                },
                {
                  "lessThan": "7d75570002929d20e40110d6b03e46202c9d1bc7",
                  "status": "affected",
                  "version": "2871aa407007f6f531fae181ad252486e022df42",
                  "versionType": "git"
                },
                {
                  "lessThan": "fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4",
                  "status": "affected",
                  "version": "24e05760186dc070d3db190ca61efdbce23afc88",
                  "versionType": "git"
                },
                {
                  "lessThan": "3def5243150716be86599c2a1767c29c68838b6d",
                  "status": "affected",
                  "version": "efa56305908ba20de2104f1b8508c6a7401833be",
                  "versionType": "git"
                },
                {
                  "lessThan": "374b095e265fa27465f34780e0eb162ff1bef913",
                  "status": "affected",
                  "version": "efa56305908ba20de2104f1b8508c6a7401833be",
                  "versionType": "git"
                },
                {
                  "lessThan": "32b63acd78f577b332d976aa06b56e70d054cbba",
                  "status": "affected",
                  "version": "efa56305908ba20de2104f1b8508c6a7401833be",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "ee5e7632e981673f42a50ade25e71e612e543d9d",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.10.249",
                  "status": "affected",
                  "version": "5.10.209",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.15.199",
                  "status": "affected",
                  "version": "5.15.148",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.1.162",
                  "status": "affected",
                  "version": "6.1.75",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.6.122",
                  "status": "affected",
                  "version": "6.6.14",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.5",
                  "status": "affected",
                  "version": "5.4.268",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.8",
                  "status": "affected",
                  "version": "6.7.2",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/nvme/target/tcp.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.8"
                },
                {
                  "lessThan": "6.8",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.249",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.199",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.162",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.122",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.67",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.249",
                      "versionStartIncluding": "5.10.209",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.199",
                      "versionStartIncluding": "5.15.148",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.162",
                      "versionStartIncluding": "6.1.75",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.122",
                      "versionStartIncluding": "6.6.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.67",
                      "versionStartIncluding": "6.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.7",
                      "versionStartIncluding": "6.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.19",
                      "versionStartIncluding": "6.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.4.268",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.7.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec\n\nCommit efa56305908b (\"nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\")\nadded ttag bounds checking and data_offset\nvalidation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate\nwhether the command\u0027s data structures (cmd-\u003ereq.sg and cmd-\u003eiov) have\nbeen properly initialized before processing H2C_DATA PDUs.\n\nThe nvmet_tcp_build_pdu_iovec() function dereferences these pointers\nwithout NULL checks. This can be triggered by sending H2C_DATA PDU\nimmediately after the ICREQ/ICRESP handshake, before\nsending a CONNECT command or NVMe write command.\n\nAttack vectors that trigger NULL pointer dereferences:\n1. H2C_DATA PDU sent before CONNECT \u2192 both pointers NULL\n2. H2C_DATA PDU for READ command \u2192 cmd-\u003ereq.sg allocated, cmd-\u003eiov NULL\n3. H2C_DATA PDU for uninitialized command slot \u2192 both pointers NULL\n\nThe fix validates both cmd-\u003ereq.sg and cmd-\u003eiov before calling\nnvmet_tcp_build_pdu_iovec(). Both checks are required because:\n- Uninitialized commands: both NULL\n- READ commands: cmd-\u003ereq.sg allocated, cmd-\u003eiov NULL\n- WRITE commands: both allocated"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-23T16:03:38.884Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/baabe43a0edefac8cd7b981ff87f967f6034dafe"
            },
            {
              "url": "https://git.kernel.org/stable/c/76abc83a9d25593c2b7613c549413079c14a4686"
            },
            {
              "url": "https://git.kernel.org/stable/c/7d75570002929d20e40110d6b03e46202c9d1bc7"
            },
            {
              "url": "https://git.kernel.org/stable/c/fdecd3b6aac10d5a18d0dc500fe57f8648b66cd4"
            },
            {
              "url": "https://git.kernel.org/stable/c/3def5243150716be86599c2a1767c29c68838b6d"
            },
            {
              "url": "https://git.kernel.org/stable/c/374b095e265fa27465f34780e0eb162ff1bef913"
            },
            {
              "url": "https://git.kernel.org/stable/c/32b63acd78f577b332d976aa06b56e70d054cbba"
            }
          ],
          "title": "nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-22998",
        "datePublished": "2026-01-25T14:36:12.935Z",
        "dateReserved": "2026-01-13T15:37:45.938Z",
        "dateUpdated": "2026-06-16T20:38:12.309Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.