CVE-2026-98723

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: copy the hostid into the ctrl before creating PR pc_refs

Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and

implementation") added a second uuid_copy() of args->hostid near the end

of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate

uuid_copy") removed the original copy that sat before

nvmet_ctrl_init_pr() instead of the new one.

Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the

per-controller per-namespace reservation refs while the uuid_copy()

from the connect data runs later, after the controller is published.

The ctrl is allocated with kzalloc(), so every pc_ref created on this

path stores the nil UUID.

pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort()

matches it against the preempted registrant's hostid to kill and drain

the victim's in-flight I/O for Preempt and Abort. The match can never

hit with the nil UUID, so whenever a namesp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References