CVE-2026-98723 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems with nvmet enabled, particularly those with reservations enabled, should assess exposure, verify kernel versions, and apply patches as necessary. Security teams and vulnerability management teams should also review and monitor system logs for potential Preempt and Abort operation failures.

Why it matters

A vulnerability in the Linux kernel's nvmet subsystem can cause Preempt and Abort operations to silently degrade into a plain Preempt, potentially allowing in-flight I/O to continue uninterrupted.

• Verify Preempt and Abort operation behavior in Linux kernel versions
• Assess exposure of Linux kernel-based systems with nvmet enabled
• Monitor system logs for potential Preempt and Abort operation failures

Technical summary

The vulnerability is caused by a race condition in the nvmet subsystem of the Linux kernel. The issue arises from the incorrect placement of the uuid_copy() function, which copies the hostid into the controller. This results in the pc_ref->hostid storing a nil UUID, causing the Preempt and Abort operations to fail. The vulnerability can be triggered when a namespace with reservations enabled exists before a host connects, which includes every reconnect. Affected Linux kernel developers and maintainers should review and apply patches. Linux distribution vendors and users of Linux-based systems with nvmet enabled, particularly those with reservations enabled, should assess exposure and verify kernel versions.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the available patches to the Linux kernel
• Verify the Linux kernel version and update if necessary
• Monitor system logs for potential Preempt and Abort operation failures
• Assess exposure of Linux kernel-based systems with nvmet enabled
• Verify Preempt and Abort operation behavior in Linux kernel versions
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a race condition in the nvmet subsystem of the Linux kernel. The issue arises from the incorrect placement of the uuid_copy() function, which copies the hostid into the controller. This results in the pc_ref->hostid storing a nil UUID, causing the Preempt and Abort operations to fail. The vulnerability can be triggered when a namespace with reservations enabled exists before a host connects, which includes every reconnect.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.