PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22998 Linux CVE debrief

The Linux kernel was vulnerable to a high-severity issue, CVE-2026-22998, which involved NULL pointer dereferences in the nvmet_tcp_build_pdu_iov function. This vulnerability was caused by inadequate validation of command data structures before processing H2C_DATA PDUs. Attackers could exploit this by sending H2C_DATA PDUs in specific sequences, such as before a CONNECT command or with uninitialized command slots. The vulnerability has been patched in various kernel versions, including 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, and 6.7.2.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-25
Original CVE updated
2026-06-17
Advisory published
2026-01-25
Advisory updated
2026-06-17

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using nvme-tcp, should be aware of this vulnerability. They should assess their systems for exposure and apply patches or mitigations as necessary.

Technical summary

CVE-2026-22998 is a high-severity vulnerability in the Linux kernel's nvme-tcp implementation. The vulnerability arises from the nvmet_tcp_build_pdu_iovec function not properly checking if the command's data structures (cmd->req.sg and cmd->iov) are initialized before being dereferenced. This can be exploited by sending H2C_DATA PDUs in specific sequences, such as before a CONNECT command or with uninitialized command slots, leading to NULL pointer dereferences. The vulnerability has a CVSS score of 7.5 and is classified under CWE-476.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates to affected kernel versions.
  • Restrict access to nvme-tcp services to trusted sources.
  • Monitor system logs for suspicious nvme-tcp activity.
  • Implement additional validation for H2C_DATA PDUs.
  • Consider using alternative storage protocols if possible.
  • Regularly review and update system configurations.

Evidence notes

The CVE-2026-22998 vulnerability was identified and patched by the Linux kernel community. Multiple patches were applied to various kernel branches to address this issue. The vulnerability details and patches are publicly available on kernel.org and other Linux resources.

Official resources

Publicly disclosed