CVE-2026-98724 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and prioritize patching or mitigation. Linux kernel developers and maintainers need to verify Linux kernel versions and configurations for exposure. Linux distribution vendors should prioritize patching or mitigating affected systems. Users of Linux-based systems must monitor system logs for potential exploitation attempts.

Why it matters

A vulnerability in the Linux kernel's nvmet subsystem can cause a slab-out-of-bounds read when handling SGL segments. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and prioritize patching or mitigation.

• Verify Linux kernel versions and configurations for exposure
• Prioritize patching or mitigating affected systems
• Monitor system logs for potential exploitation attempts

Technical summary

The Linux kernel's nvmet subsystem is vulnerable to a slab-out-of-bounds read when handling SGL segments. This occurs when the host controls an SGL segment's length to be nonzero but smaller than one SGL descriptor, causing nr_descs to be zero. As a result, nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside the allocated buffer. The issue was reproduced in 3/3 KASAN boots with a KUnit test that mocked the host transfer. Affected Linux kernel developers and maintainers should assess exposure and prioritize patching or mitigation.

Defensive priority

Verify Linux kernel versions and configurations for exposure; prioritize patching or mitigating affected systems.

Recommended defensive actions

• Verify Linux kernel versions and configurations for exposure
• Prioritize patching or mitigating affected systems
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a description of the issue and its potential impact. However, the record does not provide information on known affected versions or exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.