CVE-2026-22998

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length")

added ttag bounds checking and data_offset

validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate

whether the command's data structures (cmd->req.sg and cmd->iov) have

been properly initialized before processing H2C_DATA PDUs.

The nvmet_tcp_build_pdu_iovec() function dereferences these pointers

without NULL checks. This can be triggered by sending H2C_DATA PDU

immediately after the ICREQ/ICRESP handshake, before

sending a CONNECT command or NVMe write command.

Attack vectors that trigger NULL pointer dereferences:

1. H2C_DATA PDU sent before CONNECT → both pointers NULL

2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL

3. H2C_DATA PDU for uninitialized command slot → both pointers NULL

The fix validates both cmd->r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References